50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe
Size

468KB
MD5

cb53a9693e8f40bc2f20eba976a96b90
SHA1

02d480f546d9aeedae0a15956e3ad6e5b7b3fb6c
SHA256

50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300
SHA512

6f05f576320ba62b1f333bd6b626d25d8d7a3d1892cbe5a3b508cd72aa0782426daefe0d7101767bed10ca3388fb408b611729ee625f54b0aa6ed5d6a63be86f
SSDEEP

3072:L1NhogLVap8Ukb/sPz5WfZXcfzrtH8anmHe5OVp26s43J1XRCcly:L1foF6UkYP1WfZocwT6smPXRC

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2388	Unicorn-62740.exe
2300	Unicorn-19892.exe
1460	Unicorn-1095.exe
4804	Unicorn-1967.exe
3240	Unicorn-56212.exe
2612	Unicorn-45998.exe
3504	Unicorn-36346.exe
892	Unicorn-5387.exe
4284	Unicorn-54323.exe
4632	Unicorn-45844.exe
1344	Unicorn-12979.exe
3468	Unicorn-50483.exe
1100	Unicorn-6849.exe
4368	Unicorn-58651.exe
1776	Unicorn-12979.exe
1504	Unicorn-7307.exe
2376	Unicorn-9014.exe
720	Unicorn-12543.exe
1936	Unicorn-11566.exe
5028	Unicorn-15481.exe
3912	Unicorn-20136.exe
2844	Unicorn-4546.exe
1308	Unicorn-24412.exe
3476	Unicorn-62792.exe
2044	Unicorn-17121.exe
4908	Unicorn-18473.exe
4132	Unicorn-24339.exe
840	Unicorn-4738.exe
2232	Unicorn-24604.exe
3960	Unicorn-18896.exe
3328	Unicorn-56207.exe
2840	Unicorn-35424.exe
2996	Unicorn-4597.exe
3176	Unicorn-48231.exe
4964	Unicorn-10343.exe
1288	Unicorn-56015.exe
1748	Unicorn-53083.exe
3448	Unicorn-15387.exe
4920	Unicorn-44671.exe
3252	Unicorn-61272.exe
1672	Unicorn-34913.exe
4876	Unicorn-41044.exe
692	Unicorn-32876.exe
1004	Unicorn-42113.exe
64	Unicorn-16540.exe
2432	Unicorn-9248.exe
3744	Unicorn-11.exe
4888	Unicorn-35621.exe
432	Unicorn-24686.exe
3708	Unicorn-4095.exe
2328	Unicorn-21671.exe
3028	Unicorn-13917.exe
2340	Unicorn-19086.exe
2656	Unicorn-35407.exe
4916	Unicorn-41272.exe
1848	Unicorn-21671.exe
1860	Unicorn-53296.exe
3444	Unicorn-21671.exe
4676	Unicorn-203.exe
4872	Unicorn-33260.exe
1096	Unicorn-23045.exe
4560	Unicorn-33260.exe
844	Unicorn-9632.exe
5096	Unicorn-61848.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2352	3476	WerFault.exe	112
11048	2656	WerFault.exe	144

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15219.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1416	dwm.exe
Token: SeChangeNotifyPrivilege	1416	dwm.exe
Token: 33	1416	dwm.exe
Token: SeIncBasePriorityPrivilege	1416	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe
2388	Unicorn-62740.exe
2300	Unicorn-19892.exe
1460	Unicorn-1095.exe
4804	Unicorn-1967.exe
3504	Unicorn-36346.exe
2612	Unicorn-45998.exe
3240	Unicorn-56212.exe
892	Unicorn-5387.exe
4284	Unicorn-54323.exe
4632	Unicorn-45844.exe
4368	Unicorn-58651.exe
1344	Unicorn-12979.exe
1776	Unicorn-12979.exe
1100	Unicorn-6849.exe
3468	Unicorn-50483.exe
1504	Unicorn-7307.exe
2376	Unicorn-9014.exe
720	Unicorn-12543.exe
1936	Unicorn-11566.exe
3476	Unicorn-62792.exe
1308	Unicorn-24412.exe
2844	Unicorn-4546.exe
3912	Unicorn-20136.exe
5028	Unicorn-15481.exe
4908	Unicorn-18473.exe
4132	Unicorn-24339.exe
840	Unicorn-4738.exe
2232	Unicorn-24604.exe
2044	Unicorn-17121.exe
3960	Unicorn-18896.exe
3328	Unicorn-56207.exe
2840	Unicorn-35424.exe
2996	Unicorn-4597.exe
3176	Unicorn-48231.exe
1288	Unicorn-56015.exe
4964	Unicorn-10343.exe
1748	Unicorn-53083.exe
3448	Unicorn-15387.exe
4920	Unicorn-44671.exe
3252	Unicorn-61272.exe
692	Unicorn-32876.exe
4876	Unicorn-41044.exe
1672	Unicorn-34913.exe
1004	Unicorn-42113.exe
4888	Unicorn-35621.exe
2432	Unicorn-9248.exe
64	Unicorn-16540.exe
4916	Unicorn-41272.exe
432	Unicorn-24686.exe
3708	Unicorn-4095.exe
3028	Unicorn-13917.exe
2656	Unicorn-35407.exe
2340	Unicorn-19086.exe
3444	Unicorn-21671.exe
1848	Unicorn-21671.exe
3744	Unicorn-11.exe
2328	Unicorn-21671.exe
1860	Unicorn-53296.exe
1096	Unicorn-23045.exe
4676	Unicorn-203.exe
4872	Unicorn-33260.exe
4560	Unicorn-33260.exe
844	Unicorn-9632.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 2388	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	84
PID 4260 wrote to memory of 2388	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	84
PID 4260 wrote to memory of 2388	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	84
PID 2388 wrote to memory of 2300	2388	Unicorn-62740.exe	87
PID 2388 wrote to memory of 2300	2388	Unicorn-62740.exe	87
PID 2388 wrote to memory of 2300	2388	Unicorn-62740.exe	87
PID 4260 wrote to memory of 1460	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	88
PID 4260 wrote to memory of 1460	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	88
PID 4260 wrote to memory of 1460	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	88
PID 2300 wrote to memory of 4804	2300	Unicorn-19892.exe	90
PID 2300 wrote to memory of 4804	2300	Unicorn-19892.exe	90
PID 2300 wrote to memory of 4804	2300	Unicorn-19892.exe	90
PID 1460 wrote to memory of 3240	1460	Unicorn-1095.exe	92
PID 1460 wrote to memory of 3240	1460	Unicorn-1095.exe	92
PID 1460 wrote to memory of 3240	1460	Unicorn-1095.exe	92
PID 4260 wrote to memory of 2612	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	93
PID 4260 wrote to memory of 2612	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	93
PID 4260 wrote to memory of 2612	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	93
PID 2388 wrote to memory of 3504	2388	Unicorn-62740.exe	91
PID 2388 wrote to memory of 3504	2388	Unicorn-62740.exe	91
PID 2388 wrote to memory of 3504	2388	Unicorn-62740.exe	91
PID 2612 wrote to memory of 892	2612	Unicorn-45998.exe	96
PID 2612 wrote to memory of 892	2612	Unicorn-45998.exe	96
PID 2612 wrote to memory of 892	2612	Unicorn-45998.exe	96
PID 4260 wrote to memory of 4284	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	97
PID 4260 wrote to memory of 4284	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	97
PID 4260 wrote to memory of 4284	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	97
PID 3504 wrote to memory of 4632	3504	Unicorn-36346.exe	98
PID 3504 wrote to memory of 4632	3504	Unicorn-36346.exe	98
PID 3504 wrote to memory of 4632	3504	Unicorn-36346.exe	98
PID 3240 wrote to memory of 1344	3240	Unicorn-56212.exe	100
PID 3240 wrote to memory of 1344	3240	Unicorn-56212.exe	100
PID 3240 wrote to memory of 1344	3240	Unicorn-56212.exe	100
PID 1460 wrote to memory of 3468	1460	Unicorn-1095.exe	103
PID 1460 wrote to memory of 3468	1460	Unicorn-1095.exe	103
PID 1460 wrote to memory of 3468	1460	Unicorn-1095.exe	103
PID 2300 wrote to memory of 4368	2300	Unicorn-19892.exe	101
PID 2300 wrote to memory of 4368	2300	Unicorn-19892.exe	101
PID 2300 wrote to memory of 4368	2300	Unicorn-19892.exe	101
PID 2388 wrote to memory of 1100	2388	Unicorn-62740.exe	99
PID 2388 wrote to memory of 1100	2388	Unicorn-62740.exe	99
PID 2388 wrote to memory of 1100	2388	Unicorn-62740.exe	99
PID 4804 wrote to memory of 1776	4804	Unicorn-1967.exe	102
PID 4804 wrote to memory of 1776	4804	Unicorn-1967.exe	102
PID 4804 wrote to memory of 1776	4804	Unicorn-1967.exe	102
PID 892 wrote to memory of 1504	892	Unicorn-5387.exe	104
PID 892 wrote to memory of 1504	892	Unicorn-5387.exe	104
PID 892 wrote to memory of 1504	892	Unicorn-5387.exe	104
PID 2612 wrote to memory of 2376	2612	Unicorn-45998.exe	105
PID 2612 wrote to memory of 2376	2612	Unicorn-45998.exe	105
PID 2612 wrote to memory of 2376	2612	Unicorn-45998.exe	105
PID 4284 wrote to memory of 720	4284	Unicorn-54323.exe	106
PID 4284 wrote to memory of 720	4284	Unicorn-54323.exe	106
PID 4284 wrote to memory of 720	4284	Unicorn-54323.exe	106
PID 2300 wrote to memory of 1936	2300	Unicorn-19892.exe	107
PID 2300 wrote to memory of 1936	2300	Unicorn-19892.exe	107
PID 2300 wrote to memory of 1936	2300	Unicorn-19892.exe	107
PID 4260 wrote to memory of 5028	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	109
PID 4260 wrote to memory of 5028	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	109
PID 4260 wrote to memory of 5028	4260	50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe	109
PID 1344 wrote to memory of 3912	1344	Unicorn-12979.exe	111
PID 1344 wrote to memory of 3912	1344	Unicorn-12979.exe	111
PID 1344 wrote to memory of 3912	1344	Unicorn-12979.exe	111
PID 1776 wrote to memory of 1308	1776	Unicorn-12979.exe	110

C:\Users\Admin\AppData\Local\Temp\50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe
"C:\Users\Admin\AppData\Local\Temp\50d5e01b34cd515955b61e8f6615271e4096f36583c9d9cc89bf0a7ac1fef300N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62740.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62740.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41044.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51132.exe
        8⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        9⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe
        10⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33953.exe
        11⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        10⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24006.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4325.exe
        9⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        9⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        9⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        9⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19038.exe
        9⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
        9⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        8⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        8⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27784.exe
        8⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3254.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        8⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe
        9⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        9⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15837.exe
        9⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe
        8⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26221.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        8⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17782.exe
        7⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20513.exe
        8⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        8⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60830.exe
        7⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33172.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe
        8⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16460.exe
        9⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57254.exe
        9⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53963.exe
        8⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
        8⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        8⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19222.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        8⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5110.exe
        8⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7414.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        7⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32264.exe
        7⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        8⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        8⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        8⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        7⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        7⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe
        6⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe
        6⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4546.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61272.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
        7⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        8⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61184.exe
        9⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7170.exe
        9⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55665.exe
        9⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        8⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
        8⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        8⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        8⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24852.exe
        7⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        6⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        8⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34860.exe
        8⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62846.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9386.exe
        7⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11588.exe
        7⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26221.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
        7⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
        7⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14388.exe
        7⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7929.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41757.exe
        6⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34913.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe
        6⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        8⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        7⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13801.exe
        7⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44639.exe
        6⤵
        
        PID:12732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21723.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56968.exe
        7⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        6⤵
        
        PID:14488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21073.exe
        6⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8149.exe
        5⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25692.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
        6⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        5⤵
        
        PID:15772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58651.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61848.exe
        6⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1267.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20204.exe
        8⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe
        9⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45770.exe
        9⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
        8⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63600.exe
        8⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50866.exe
        8⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2457.exe
        7⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7172.exe
        7⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22818.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20152.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
        7⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        7⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4805.exe
        6⤵
        
        PID:13860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        6⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60762.exe
        5⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19038.exe
        7⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35245.exe
        7⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46039.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58430.exe
        6⤵
        
        PID:12268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe
        6⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48310.exe
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        6⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe
        6⤵
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5127.exe
        5⤵
        
        PID:10664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35309.exe
        5⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50789.exe
        5⤵
        
        PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11566.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50364.exe
        6⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9819.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14591.exe
        9⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        8⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10961.exe
        8⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
        7⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11588.exe
        7⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16460.exe
        7⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        7⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        7⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18401.exe
        6⤵
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27969.exe
        6⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23290.exe
        5⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1952.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63592.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        8⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        8⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48434.exe
        8⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
        7⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        7⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24338.exe
        7⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        7⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
        7⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43921.exe
        6⤵
        
        PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36554.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        6⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56968.exe
        7⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        6⤵
        
        PID:11832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        6⤵
        
        PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16054.exe
        5⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6813.exe
        5⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        5⤵
        
        PID:15472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44671.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe
        5⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
        6⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30684.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        7⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        6⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        6⤵
        
        PID:15552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20462.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe
        6⤵
        
        PID:12856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        6⤵
        
        PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43822.exe
        5⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        5⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
        5⤵
        
        PID:15488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13997.exe
      4⤵
      PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10395.exe
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        7⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        7⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        6⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62375.exe
        5⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        5⤵
        
        PID:13528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
      4⤵
      PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14731.exe
        5⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22074.exe
        5⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        5⤵
        
        PID:15588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9647.exe
      4⤵
      PID:8576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
      4⤵
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
      4⤵
      PID:6932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36346.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45844.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17121.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53296.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50032.exe
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
        9⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        9⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        8⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60890.exe
        8⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        8⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        8⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
        8⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19841.exe
        7⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
        7⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        7⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48392.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32264.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        8⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36642.exe
        8⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60507.exe
        7⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        7⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        7⤵
        
        PID:16252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        6⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12183.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
        7⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14762.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21671.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24080.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        8⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4534.exe
        8⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        8⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
        7⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        7⤵
        
        PID:15780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61302.exe
        6⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        6⤵
        
        PID:15372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23860.exe
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        6⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56730.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54959.exe
        5⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16202.exe
        5⤵
        
        PID:456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4738.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30048.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
        8⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        8⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26692.exe
        8⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42094.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        7⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        7⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54094.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44639.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44113.exe
        6⤵
        
        PID:15564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        5⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5110.exe
        6⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48434.exe
        6⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
        5⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20486.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        5⤵
        
        PID:7196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19996.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        7⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7466.exe
        7⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        7⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        6⤵
        
        PID:15788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
        5⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35412.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2265.exe
        5⤵
        
        PID:11272
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 660
        5⤵
        Program crash
        
        PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
      4⤵
      PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        5⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56174.exe
        5⤵
        
        PID:15592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
      4⤵
      PID:8768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
      4⤵
      PID:12208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
      4⤵
      PID:2888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24604.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42113.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23696.exe
        6⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9819.exe
        7⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
        8⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        8⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63143.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9613.exe
        7⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65230.exe
        7⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        7⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        6⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        6⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
        5⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        7⤵
        
        PID:11792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
        6⤵
        
        PID:12772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        6⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49267.exe
        6⤵
        
        PID:14536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59256.exe
        5⤵
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64286.exe
        5⤵
        
        PID:14464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64482.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21671.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20920.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4015.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
        7⤵
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
        6⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38306.exe
        6⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56129.exe
        6⤵
        
        PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe
        5⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13173.exe
        5⤵
        
        PID:10948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        5⤵
        
        PID:696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
      4⤵
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59464.exe
        5⤵
        
        PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        5⤵
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
        5⤵
        
        PID:16256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64856.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        5⤵
        
        PID:14424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29110.exe
      4⤵
      PID:12600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
      4⤵
      PID:8280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        5⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32264.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60507.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60454.exe
        7⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
        7⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12654.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32060.exe
        6⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20462.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10071.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55281.exe
        6⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
        5⤵
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50079.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3254.exe
      4⤵
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47536.exe
        5⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        6⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1498.exe
        5⤵
        
        PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1445.exe
        5⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        5⤵
        
        PID:9124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        5⤵
        
        PID:14308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        5⤵
        
        PID:668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
      4⤵
      PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
      4⤵
      PID:13364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35621.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40608.exe
      4⤵
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6607.exe
        5⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
        6⤵
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
        6⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
        5⤵
        
        PID:8672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38306.exe
        5⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20061.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54583.exe
      4⤵
      PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        5⤵
        
        PID:13044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7172.exe
      4⤵
      PID:1772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
    3⤵
    PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
      4⤵
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe
        5⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7808.exe
        5⤵
        
        PID:16244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62131.exe
      4⤵
      PID:9588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21201.exe
      4⤵
      PID:14196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
      4⤵
      PID:15456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exe
    3⤵
    PID:7392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51702.exe
    3⤵
    PID:10536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10309.exe
    3⤵
    PID:5484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56212.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31480.exe
        7⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        8⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8510.exe
        9⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3521.exe
        8⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39096.exe
        8⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        7⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11588.exe
        7⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13275.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
        8⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        8⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14388.exe
        8⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
        7⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        7⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
        6⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16460.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        7⤵
        
        PID:15348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        7⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1010.exe
        6⤵
        
        PID:10688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64674.exe
        6⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21671.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
        6⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        7⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3521.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        7⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
        6⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3330.exe
        6⤵
        
        PID:14528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2729.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38849.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65115.exe
        7⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        7⤵
        
        PID:15500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39510.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25158.exe
        6⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28600.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
        6⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        5⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65047.exe
        5⤵
        
        PID:14864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3476
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 468
        5⤵
        Program crash
        
        PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        6⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
        7⤵
        
        PID:12252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        6⤵
        
        PID:13096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        5⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        6⤵
        
        PID:13156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26308.exe
        6⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        5⤵
        
        PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54671.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        5⤵
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        5⤵
        
        PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
      4⤵
      PID:8328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62512.exe
      4⤵
      PID:12068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50483.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1355.exe
        5⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1267.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        8⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        7⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19718.exe
        7⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        7⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12597.exe
        6⤵
        
        PID:10816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        6⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        6⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19038.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        6⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        5⤵
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        5⤵
        
        PID:15604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
      4⤵
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        5⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        6⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        6⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37870.exe
        5⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56968.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1473.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46863.exe
        5⤵
        
        PID:12300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe
        5⤵
        
        PID:14244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
      4⤵
      PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47519.exe
      4⤵
      PID:8308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56931.exe
      4⤵
      PID:13056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
      4⤵
      PID:7044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45953.exe
        5⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17360.exe
        6⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        7⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
        7⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
        6⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48963.exe
        5⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47305.exe
        6⤵
        
        PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
        5⤵
        
        PID:10732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        5⤵
        
        PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51599.exe
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32321.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        5⤵
        
        PID:11968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        5⤵
        
        PID:16212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
      4⤵
      PID:8716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
      4⤵
      PID:12928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7172.exe
      4⤵
      PID:15540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41272.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7743.exe
      4⤵
      PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57254.exe
        6⤵
        
        PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
        5⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38306.exe
        5⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49511.exe
        5⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        5⤵
        
        PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61791.exe
      4⤵
      PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20944.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
      4⤵
      PID:10244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
      4⤵
      PID:3532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
    3⤵
    PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
      4⤵
      PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6106.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
      4⤵
      PID:15032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
      4⤵
      PID:15800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
    3⤵
    PID:7780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
      4⤵
      PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
      4⤵
      PID:15272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
      4⤵
      PID:7100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10327.exe
    3⤵
    PID:10808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
    3⤵
    PID:15204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50789.exe
    3⤵
    PID:7208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18896.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25004.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49072.exe
        8⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19304.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22224.exe
        9⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56895.exe
        8⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24133.exe
        8⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        8⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35262.exe
        7⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8130.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        7⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47323.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59848.exe
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58831.exe
        7⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        6⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24852.exe
        6⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
        5⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41008.exe
        7⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22568.exe
        8⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16849.exe
        8⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29287.exe
        7⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
        7⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6807.exe
        7⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57882.exe
        7⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        7⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12654.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20601.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        6⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        6⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
        6⤵
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48919.exe
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44063.exe
        5⤵
        
        PID:12308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        5⤵
        
        PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56207.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33857.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        8⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62951.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        7⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54583.exe
        6⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20513.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        7⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62951.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15340.exe
        6⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        5⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        6⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20513.exe
        7⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        6⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe
        5⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
        5⤵
        
        PID:12316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23045.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24080.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        6⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        7⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        7⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1549.exe
        6⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        6⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62751.exe
        5⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15340.exe
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe
      4⤵
      PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47347.exe
        5⤵
        
        PID:14072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
      4⤵
      PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28103.exe
      4⤵
      PID:12692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57235.exe
      4⤵
      PID:384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        6⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31112.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62344.exe
        8⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        8⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38306.exe
        7⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36144.exe
        7⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        6⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24845.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55491.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29561.exe
        6⤵
        
        PID:13344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4161.exe
        6⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        5⤵
        
        PID:12892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18438.exe
      4⤵
      PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exe
        5⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24353.exe
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        6⤵
        
        PID:16004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        5⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        5⤵
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
      4⤵
      PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33473.exe
        5⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19038.exe
        5⤵
        
        PID:11296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26221.exe
      4⤵
      PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
      4⤵
      PID:12452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
      4⤵
      PID:15508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4597.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9632.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62951.exe
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64925.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        5⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        5⤵
        
        PID:15124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        5⤵
        
        PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
      4⤵
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        5⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51073.exe
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21317.exe
        6⤵
        
        PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        5⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        5⤵
        
        PID:16008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe
      4⤵
      PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
      4⤵
      PID:12200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
      4⤵
      PID:16304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
    3⤵
    PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14287.exe
      4⤵
      PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26465.exe
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        5⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        5⤵
        
        PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54311.exe
      4⤵
      PID:12652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
      4⤵
      PID:7296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
    3⤵
    PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51488.exe
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
      4⤵
      PID:13244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58242.exe
      4⤵
      PID:3812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
    3⤵
    PID:7560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
    3⤵
    PID:13072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24656.exe
    3⤵
    PID:16316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54323.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54323.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12543.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10343.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
        5⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1952.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32264.exe
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        8⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56678.exe
        8⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2841.exe
        7⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        7⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
        6⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18593.exe
        7⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4405.exe
        7⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11777.exe
        6⤵
        
        PID:11644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
        6⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        6⤵
        
        PID:13124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        5⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        5⤵
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
        5⤵
        
        PID:16328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23783.exe
      4⤵
      PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26216.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
        6⤵
        
        PID:12644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        5⤵
        
        PID:8960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41675.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6160.exe
        5⤵
        
        PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36554.exe
      4⤵
      PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37648.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe
        5⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        5⤵
        
        PID:15676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
      4⤵
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43570.exe
      4⤵
      PID:12660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53083.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
      4⤵
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        6⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
        7⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
        6⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        5⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        5⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        5⤵
        
        PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61495.exe
      4⤵
      PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        5⤵
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        5⤵
        
        PID:13104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
      4⤵
      PID:8252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
      4⤵
      PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
      4⤵
      PID:16296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15453.exe
    3⤵
    PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2336.exe
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8757.exe
        5⤵
        
        PID:14268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46039.exe
      4⤵
      PID:8536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54346.exe
      4⤵
      PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24582.exe
      4⤵
      PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48310.exe
    3⤵
    PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
      4⤵
      PID:9808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
      4⤵
      PID:14112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
      4⤵
      PID:2628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51295.exe
    3⤵
    PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19060.exe
      4⤵
      PID:12376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25372.exe
    3⤵
    PID:13476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:64
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40608.exe
      4⤵
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        5⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        5⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3521.exe
        5⤵
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        5⤵
        
        PID:712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
      4⤵
      PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
        5⤵
        
        PID:15248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
        5⤵
        
        PID:15368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
      4⤵
      PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
      4⤵
      PID:13624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11396.exe
      4⤵
      PID:7108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54531.exe
    3⤵
    PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30188.exe
      4⤵
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59023.exe
        5⤵
        
        PID:12768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        5⤵
        
        PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
      4⤵
      PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38306.exe
      4⤵
      PID:14008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6901.exe
      4⤵
      PID:4580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14073.exe
    3⤵
    PID:7432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15831.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36137.exe
    3⤵
    PID:13624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19996.exe
    3⤵
    PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62476.exe
      4⤵
      PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50497.exe
        5⤵
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21317.exe
        5⤵
        
        PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33542.exe
      4⤵
      PID:9532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
      4⤵
      PID:13984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
      4⤵
      PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
    3⤵
    PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
      4⤵
      PID:10548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45375.exe
      4⤵
      PID:14984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
      4⤵
      PID:15632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
    3⤵
    PID:10776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
    3⤵
    PID:14952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
    3⤵
    PID:6732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33516.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33516.exe
  2⤵
  PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
    3⤵
    PID:8032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
    3⤵
    PID:11472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
    3⤵
    PID:16180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
  2⤵
  PID:8472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17727.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17727.exe
  2⤵
  PID:12164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
  2⤵
  PID:5912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3476 -ip 3476
1⤵
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2656 -ip 2656
1⤵
PID:15016

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe

Filesize
468KB

MD5
1f474ac38e5da12fe949646e6cf12a77

SHA1
d3ce15dcfe62716f06a24ddd3e5688a336b201ec

SHA256
fa9032dd441a75844de929ee99c001ed9839a05abf885dec4698606b2b1b9182

SHA512
7f562bd5a5117a8b4444ea5380e22e1c18b416c3e985a1a6cc4e3b2e0fa8ac16cad51286e3ba43d86d10caa28e7be67a28a3b1f06db3148ca350891ffbd34b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11566.exe

Filesize
468KB

MD5
09db49fce4e21064e0afc00daeeacd3f

SHA1
db8bf543647d9d9a6c1119af210fd43bb8dc48bb

SHA256
4694407fc259d38067480699f74c7ba32b63688d0068c97909c21f5760d638ed

SHA512
a175bb5ff7e3fe87bbcb1175edec68a4b084fb37eabcbb0cd6d833091df6fa1d297c7b629d23f776ac5dfe0f1693d137cc529c2e9894fb018876d0ab97609d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12543.exe

Filesize
468KB

MD5
9e76d87e725cf21d0cadc3bf88932dcd

SHA1
97df70a6beadd2ede9d9f906b25d269d442da6ff

SHA256
e0c70532ae351718c86b452fbe5570d4ec5ea944b6e834460f9b4df1835dd964

SHA512
da34e6f4b3fcba916da6a662712c29d0ec6d66a3e0ce7f24569f007df13382c72bf2bbf798ce32184eadabd18de8279c503d1d80102c44a5f5fb350953cac5fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe

Filesize
468KB

MD5
dea7343565463639beb4b414713e47d0

SHA1
f245eb81b091e6754dba14aa5f874be6d5d2e781

SHA256
fd62ac948d81a0e02c9df7b091f4d4e66c4656641e432d93f9dc64ca4b7da4fe

SHA512
e5f2809a220bd1731aa3bf9a88097578caea6887fe8ee47abc3e44c7f18e8823afcd0c97dfc137bcc0d9eb85804a4adae131c04f67c0bc83ca4594623033ac5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe

Filesize
468KB

MD5
126460ed07448c340824f5ef18c55bf9

SHA1
60000449ea5350158a0f197139b593ab8f1db747

SHA256
5a10dfff3e1b8fa730e67b8910dd7c9c4c88a991cb1bb2c664ba53fd37e4cd62

SHA512
6f1830a76fb3ecec75799697b023177b1a0b6dd28ca5d05e93dbdc2ae7f08d2ce16bb0de460b88c831bb8c129d6605ca63d0fa9a4216f17876fba471812c27fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17121.exe

Filesize
468KB

MD5
462f293afdd23971ef87800b43f3dc22

SHA1
b7c24a85353c0b5bbf12580b2aa68fb6303e5240

SHA256
2a06fdc5738513bb4f657d93d3458b8ea4e0c861c369a273707bd54d3952a64e

SHA512
35958cd76b43758d411c39641d1a2a4b4dbab01864a2b6bb47aa1734fd2490ceea96c849d4b5c3295d284588c0e1156b3230cfed8ec55462593756a176f31741

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe

Filesize
468KB

MD5
080f135ce5f8e1982494a9e296e47dcc

SHA1
f268fa4dad0d896ac93139f0f8eeca724a4bc094

SHA256
dfa4f23cc3e8086cdc0bedb799c2f4745aed4a47f097625e824963758459b914

SHA512
4960828210f42889a2ab1fcbe2b96e68c22a3e1583e0e4db3aa3278b784d189f66539d928f11ab11a5d99f5c895bf92a360321b666018224d71ffccb8ae7ee9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18896.exe

Filesize
468KB

MD5
a70e87b76f8374290aa68228cd3ee306

SHA1
7f9552894389e7ad7d487c5385eb0e778d863a82

SHA256
b915aa3a228118566453539437fb4b97b8caca6652252d2f73cc97ac18caaf2b

SHA512
9726baf355257bcb955a2dce2a847171ad5189270befdccee4ef3978f83852900a54ce733eddd136b583e74abecd1404da271c1dede4d7c1abe269a74c5970ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe

Filesize
468KB

MD5
cd4b460b57652edfbfec053365c90f3b

SHA1
b368d2edb1f2c5bcf6124203478e4b855a10337d

SHA256
fc2c9a0f5049177fd9b24ac10703b8a87c8a4ab1bbf892d57d38f6ffe631d86d

SHA512
c92c5eebed60c19ecf4f7a937dd20ec923c9e986eff6477717335d65b7b4d09fec95000a2d4fc5d1e2003e9dbca509ceeed42c9c1364aa197c99d40399780870

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe

Filesize
468KB

MD5
3557c06d71899112e28a6af9391f8a33

SHA1
4a0d14c367ec433bac0e613c26e29595e875dafc

SHA256
d0cb9b86cc27ab88443260e091199b1de6a11a5e51ead7a3cc46737ca0a7bfff

SHA512
869a1fe1d658fee2e05b852cb542de059692330a0c253fc71d9ef4027acbfe7616d1c8837ed413c018717f14e8b6c6121ea294008ecc2ad6a706fe8e004af60a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe

Filesize
468KB

MD5
e95c5209b811c4129eaa62bbc6f801ee

SHA1
e8c513c760f64354dd1250ac921441c90f4f1fa4

SHA256
49b15ef0833515c38c6a8e96de4e30ebf62c4e9f0f434fe9f1f7fa84ccec3017

SHA512
57d71f85e51671f1ebd17e464ae140ebf3514841c478c9f51ca8fa4c8c37a764554b17c26c8d1422f1466c119620db6d3a726cb0ceafdebf67fc7ad3ce68605f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe

Filesize
468KB

MD5
9f3f66a1f476fa0c1713a7f1e84b6d8e

SHA1
11fb96d8f8e69c10b8fdc5b3ae097e06eaa6c87b

SHA256
4f6c5c22fe7a83e902d7980cedb94a1f5159382cdd171bdaae6d90c5b5ec8d04

SHA512
1c373a54deee7e5dbc40b1f72106f2ab18675335b9f1135915a3ae95ccabaccf44595248a2bb072d331bf097ff3c5966836b0921f05320260ec17cb4cea9836c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe

Filesize
468KB

MD5
de96a32224011c3621ff1d830791d8fb

SHA1
03056c615bfd84ee40b95efa137513d93ce4d182

SHA256
01d03309d38b60d52dd8e6beca56db6f4f25c1d90de1d6e2f13f64393a24f8eb

SHA512
13fc1869f5e7e902d9b5d19855676fb8fa992c2f49ed49ac9e1ec9b29f63718c394a15f76879b06d2eea29127f15b8b70c85b4604edc132c575b01bf4863a83c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24604.exe

Filesize
468KB

MD5
2c47882249772487913f45cb2fa673cb

SHA1
696e13abaf3c4299b50507a5ccc389e90b6af28b

SHA256
90e8fff6d167f3e5751d17d7ccc22bbda270c4dd12ae933b3336705dbc3d0962

SHA512
31c84b7a51249a2bbb27baf9a9712d9a844c259a51ce9e61a6d6fefceeefc273ae4da5b62f9066680c632e7699b470fa251c4ef21c998de8d4edfa74475d1918

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe

Filesize
468KB

MD5
e295dec8d9fb3cc1db0f9508f449966e

SHA1
0e66fedf8ed8ade0aa5f4804750ea1a308507064

SHA256
b1e7e8cf5a268d479237edb79a6a7bcca38c05bf162bdfdc5812203d6071e3a5

SHA512
d9d0f23d7b1c917d53339ae877c47a72ec4f9a0ac6b8cc81ea2e81debef1c797496da32aad418ebd9c6cf383eafac13ae99848c3230f60e2fb62a5e560235b2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36346.exe

Filesize
468KB

MD5
e5b53dd178fb9a236c71874ac4cbaf22

SHA1
53a21ec19aa887f918f53de1b365acd26625a77c

SHA256
46c6e918553e72b16226f6208dc7f95260691180fc97d6eb76d7a3c2ed7e2f16

SHA512
5bb63fc04b9c1f6f2ee10e9e4f54637bf40957771f98bdc8ab7205fbfcaa16a737fc09e09c1224f9195034ab59015f360331be8fab4a1e83ea09f884d131afa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4546.exe

Filesize
468KB

MD5
28feb319d863e25460ca26c0b73cef60

SHA1
7f42b1d86a2a18286429af014749c6fccfbbc40a

SHA256
9736eeb0eac9ca1d551c29604caf5ccceec75a10b6b046dc48a6f5c3bb569305

SHA512
58a8cc3eb82efe71fb4f79f39cd2d39dce945fff387dcccdf8fda4844d253d54ba1a3f26db8e45b5b1e1bd8986cbf4961eccc4e0501b42ef9500541ba3332b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45844.exe

Filesize
468KB

MD5
40bb5cfc174502bc8a00ce6ff38c9628

SHA1
4ddaf1e53dacf99eac591ad0c880f342ed9fb3c8

SHA256
fe8c0de7a00255ca89aa49a494c966e656bc3c222a2fee9bfe911940a64bacd1

SHA512
bc23322924b46c4f29e2126d9b26b9495fdd27cb7f32c226ddf9658b7664cd79d49aaf1812451aba0c388a51a301414b2164c84070c853c71d10b2fde596eca2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe

Filesize
468KB

MD5
b8ac85b1f770b9438fc0d28ab2570673

SHA1
b1a35139212faa79d4655eed66b45e402d787b9e

SHA256
6b9e76bd69bf528089ee9f6d3a817408a6cafdbcea5b669228114d3ea5cc18fa

SHA512
4b14e983e652d19894ef5e8b8cdfaa2abd4f1b41b3911523fb345dd8b7f2edf8868c1b365401150f9ba5cbdaad7c2862af7e87de26d53a7e3623504b9a036e06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4738.exe

Filesize
468KB

MD5
4dc378db62a9b4b025a787bc508758fb

SHA1
2a25933391e386887b996aac6622d437c045affe

SHA256
49ee0880be745a7ea6e78384594a69f0fbfaf8c25f917bab6b5a0e195b57de51

SHA512
e9dc8bcea68819637f336bdf9b945281b02e19da0485091d0a783da24e29c65ca202c76824b59af96d629f4feb201aea514263f854e5448397d30af3ebdf96a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50483.exe

Filesize
468KB

MD5
5f901aa31ef57ffabc14f6b753923776

SHA1
147f186fd141cd875adaf8b09069b2e000df7063

SHA256
d082f5aa33a1cd59f2d99c6e7e480d4135097bb36a2d97fb24f563d3248c194a

SHA512
1c76023c5d77832ad5adbcc6e33b6ab7dece8d991ee75c0911141d376d3ca2bde98917427de3ad8b4669bd3500e04b96c2cb169c8f0fcd1e8e65684ebdfaab66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe

Filesize
468KB

MD5
86f48658a00d405e5a40fdb61d8b04c9

SHA1
c6504e7644b373d6a4e7a721f8e0d37be2faa277

SHA256
d142ead73c80cdc0aecf10a70983cfb3426103888ac8f3284531cd71164fcb51

SHA512
39f6ec56665446521ace4e1896c01a8b46de88f617b79c57fc461ec1cf04bd8cc00b7126558f82014a04d388fa2b7b7ade15fecb6469070c8b214d21386fde8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54323.exe

Filesize
468KB

MD5
1128d5d7ef6644a901f89efc77b0a319

SHA1
a6ecb0c9c928bab33a3cc7afd9d8a430fd117bdb

SHA256
603aa278e69a525d653a797090b698ec14286e35c720ba6ded9ab02998319d00

SHA512
27fd3a7857d075d429ce4774f643077196f4776c1e780e23137e5c12c603f894ea1dc6f70a2f5d6a0fd89b20ac5e2ef106a49c91d3f25e31bfbc7974f9f87d2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56207.exe

Filesize
468KB

MD5
b9fd53fcfab71e2649afae7405e8394a

SHA1
dfe51089a18840f5108ab597d07bd5f2fc22d140

SHA256
42d842bce8929797e666b765289d912892f0534652d96d334783f787b72bec83

SHA512
25bdf4623edcf43e52889dd3d8f541372e4846bd6967784d5a0d4b75729a6dc5e6b7e13f903ba124dcdf1219f8ef6d56bb35152149a156d49380242251554d41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56212.exe

Filesize
468KB

MD5
1d355b5d4201b5fee2cf7dffd5430a96

SHA1
b8515a0a864d3aca0155ad162151fd11be832ec6

SHA256
da8a9c03febfc53dfe51cf6aca8534dd2875972d7f10f63adffa0f03e0b3f2de

SHA512
53c0243722a9bd7d127721fc84fe7f91f0884b2fd152a9c39752c62b11255e9616c715b10339a785e498b24106e54262c32c87b4b8fa43326a4f45699f0f6c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58651.exe

Filesize
468KB

MD5
e9cb7a91a4ca47d5ef47ec827f393ef3

SHA1
73406ed5ba31676cd85dce53a13a24e0e1992f01

SHA256
8f7a08593c6a227df7cdd73466b3e17aa30579866b52cd1ee78ae50d04b825be

SHA512
318628c9b43a04f3af4657bb2a3dad2ef7c5c378df21656ada494f60eff89f8d505f6068b13facd42aeee9bccbb8a30b839b8f187cc2b244544939395e5fd0c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62740.exe

Filesize
468KB

MD5
9bdbffaf761a8e6bc24770a7ff6367ab

SHA1
f03362cfa954ff3d81ac982e46e8dd826662f14c

SHA256
ed3184392fb3568bd58bd152c7f34ab8854c6480fc6a5ad9c2773cc152e10a28

SHA512
aa06013e69eac45c5af38025cd0bbb3c346f47795eae58a4ad05c0578fee3aab654c908b1845d3f42bb899ce143d4bf116e0a5bef772b37c47fc6ab73f5ba993

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe

Filesize
468KB

MD5
8a382336bae23ce0bb9268533314cc23

SHA1
d0d17e6039c26508a467b5e780d2371ceafeb506

SHA256
c56e5d25ff377ca7972a3b3623b618e841f550f7cb3f20084057133c2aa6704b

SHA512
26e3de95636e5248915520143dc76b83a2097d25fdf5ab9877b13e60e15537a16bb17a3de5e09a729d2f3a345be60ff3df00b96c43b5156e585c888202198a06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe

Filesize
468KB

MD5
9c02e34583745386b84037b6a05288ca

SHA1
13f97d9a36faa3f032b65dc2b9d9ebb63866896b

SHA256
654ad71f7f5151c00aae5366f7cb6b5f5c12a3b7348e272736b5c96f41958eee

SHA512
58b636ffc4bf607d522b1670059de3968b904c099b92de1f9575767bd4055dbf94b3df06730be7e9cffcfeb24815540c7a23a74231648752b3ceef7b6ecfd145

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe

Filesize
468KB

MD5
f550a6fe565dd2f76672caf180ab97be

SHA1
5cd0b8194ca291c9f7f85980e15dd0601fa62f63

SHA256
ff70fb3639b462feb79497caa77e80cdebf1392124bf24955528686f6732e79f

SHA512
e7868c890069c626534f8d7fb6005587695c822245579ea5e16395485ab1bac822cf9127d200fa87f5fd0ef851710c5681fc203081413a6ececbb063cc9a80c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe

Filesize
468KB

MD5
4097de8232125084468402d3858e20ea

SHA1
46a66253e9a50b99f1ba1f73e9c1eaea7361ec50

SHA256
0ae5d018072cc6e9aab5e7c029402098ed36a00a9a4acb2ccdced01ca5078585

SHA512
845442247f3bc254d51217551eae318458fbeb12a5895d3cbf13d13981fe9da42068a423ffd7b0119a30e911ed092cdcdf3fed7929c26ac64f0af4c34a0faf99

Download Submit
memory/64-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/432-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/692-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/720-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/844-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/892-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1004-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-972-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1096-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1100-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-971-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1288-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1308-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1344-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-970-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1460-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1672-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1848-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1860-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1888-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-975-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2432-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3028-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3176-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3240-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3248-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3268-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3328-2473-0x00007FF8B04F0000-0x00007FF8B06E5000-memory.dmp

Filesize
2.0MB

Download
memory/3328-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3420-973-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3444-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3448-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3468-2510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3468-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3664-958-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3744-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3872-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3912-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4132-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4284-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-974-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-968-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4628-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4632-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4648-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4680-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4704-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4768-969-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4824-960-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4848-959-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4888-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4916-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-976-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-981-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-977-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6008-647-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads