c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901

Analysis

max time kernel
119s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe
Size

468KB
MD5

b7f4200cc8f458cfd5ad665c0e42f050
SHA1

bc91ca98aad7e75cbf7b91c77650ae848b6c027c
SHA256

c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901
SHA512

af9d216cbcaf09e21f48978e81d860def82a6029cfcb50577624f41fdbdface83e08f6f8ac2f9a6895d706df8f02a26d0feb7fa17973bb800695e1b4661eb8f8
SSDEEP

3072:5bboogVdIG8FtbEiPzxjcfN/vCtaPIFxh3HexShYTeM8bbMu3HlG:5b0oVLFtZPVjcfxA6pTe1/Mu3

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2008	Unicorn-62532.exe
3940	Unicorn-2701.exe
1924	Unicorn-48373.exe
4456	Unicorn-30273.exe
5048	Unicorn-33671.exe
2816	Unicorn-53537.exe
1796	Unicorn-14734.exe
1760	Unicorn-65457.exe
3564	Unicorn-44060.exe
3308	Unicorn-52878.exe
844	Unicorn-51617.exe
3684	Unicorn-18679.exe
4024	Unicorn-3293.exe
2804	Unicorn-48965.exe
2356	Unicorn-32628.exe
4392	Unicorn-53470.exe
4796	Unicorn-48680.exe
712	Unicorn-3008.exe
4764	Unicorn-38405.exe
2168	Unicorn-38670.exe
1292	Unicorn-17159.exe
3296	Unicorn-55857.exe
4864	Unicorn-31659.exe
2256	Unicorn-22993.exe
2060	Unicorn-334.exe
2916	Unicorn-55281.exe
1584	Unicorn-55089.exe
5068	Unicorn-19956.exe
3572	Unicorn-19956.exe
1216	Unicorn-39822.exe
4844	Unicorn-16094.exe
728	Unicorn-33678.exe
2252	Unicorn-29764.exe
4460	Unicorn-55201.exe
2788	Unicorn-2663.exe
3764	Unicorn-22337.exe
1440	Unicorn-363.exe
3868	Unicorn-8413.exe
2900	Unicorn-6960.exe
1624	Unicorn-6960.exe
1432	Unicorn-3623.exe
4580	Unicorn-334.exe
1720	Unicorn-35423.exe
4692	Unicorn-26753.exe
1656	Unicorn-39175.exe
4500	Unicorn-42705.exe
1372	Unicorn-26177.exe
1832	Unicorn-56648.exe
3576	Unicorn-48792.exe
4916	Unicorn-50977.exe
952	Unicorn-34641.exe
4468	Unicorn-1584.exe
3596	Unicorn-17921.exe
3252	Unicorn-11598.exe
2092	Unicorn-63400.exe
1492	Unicorn-45340.exe
2352	Unicorn-1008.exe
4716	Unicorn-816.exe
4860	Unicorn-63016.exe
4520	Unicorn-63016.exe
3352	Unicorn-46296.exe
4248	Unicorn-16695.exe
2896	Unicorn-2736.exe
1316	Unicorn-2352.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5484	1720	WerFault.exe	131
4992	2092	WerFault.exe	143
10404	6088	WerFault.exe	203
13064	12260	WerFault.exe	570
16116	13932	WerFault.exe	686

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22337.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
16272	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16164	dwm.exe
Token: SeChangeNotifyPrivilege	16164	dwm.exe
Token: 33	16164	dwm.exe
Token: SeIncBasePriorityPrivilege	16164	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe
2008	Unicorn-62532.exe
3940	Unicorn-2701.exe
1924	Unicorn-48373.exe
5048	Unicorn-33671.exe
2816	Unicorn-53537.exe
1796	Unicorn-14734.exe
4456	Unicorn-30273.exe
1760	Unicorn-65457.exe
3564	Unicorn-44060.exe
3308	Unicorn-52878.exe
4024	Unicorn-3293.exe
3684	Unicorn-18679.exe
2356	Unicorn-32628.exe
2804	Unicorn-48965.exe
844	Unicorn-51617.exe
4392	Unicorn-53470.exe
712	Unicorn-3008.exe
4796	Unicorn-48680.exe
4764	Unicorn-38405.exe
2168	Unicorn-38670.exe
1292	Unicorn-17159.exe
3296	Unicorn-55857.exe
4864	Unicorn-31659.exe
2060	Unicorn-334.exe
2256	Unicorn-22993.exe
1584	Unicorn-55089.exe
5068	Unicorn-19956.exe
2916	Unicorn-55281.exe
1216	Unicorn-39822.exe
4844	Unicorn-16094.exe
3572	Unicorn-19956.exe
728	Unicorn-33678.exe
2252	Unicorn-29764.exe
2788	Unicorn-2663.exe
4460	Unicorn-55201.exe
1440	Unicorn-363.exe
3764	Unicorn-22337.exe
3868	Unicorn-8413.exe
1624	Unicorn-6960.exe
1432	Unicorn-3623.exe
2900	Unicorn-6960.exe
4580	Unicorn-334.exe
1720	Unicorn-35423.exe
4692	Unicorn-26753.exe
1656	Unicorn-39175.exe
4500	Unicorn-42705.exe
1832	Unicorn-56648.exe
1372	Unicorn-26177.exe
3576	Unicorn-48792.exe
4916	Unicorn-50977.exe
3596	Unicorn-17921.exe
4468	Unicorn-1584.exe
952	Unicorn-34641.exe
3352	Unicorn-46296.exe
3252	Unicorn-11598.exe
4520	Unicorn-63016.exe
1492	Unicorn-45340.exe
4248	Unicorn-16695.exe
4716	Unicorn-816.exe
4860	Unicorn-63016.exe
2092	Unicorn-63400.exe
2352	Unicorn-1008.exe
2896	Unicorn-2736.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 2008	3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe	82
PID 3216 wrote to memory of 2008	3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe	82
PID 3216 wrote to memory of 2008	3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe	82
PID 2008 wrote to memory of 3940	2008	Unicorn-62532.exe	83
PID 2008 wrote to memory of 3940	2008	Unicorn-62532.exe	83
PID 2008 wrote to memory of 3940	2008	Unicorn-62532.exe	83
PID 3216 wrote to memory of 1924	3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe	84
PID 3216 wrote to memory of 1924	3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe	84
PID 3216 wrote to memory of 1924	3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe	84
PID 3940 wrote to memory of 4456	3940	Unicorn-2701.exe	89
PID 3940 wrote to memory of 4456	3940	Unicorn-2701.exe	89
PID 3940 wrote to memory of 4456	3940	Unicorn-2701.exe	89
PID 2008 wrote to memory of 5048	2008	Unicorn-62532.exe	90
PID 2008 wrote to memory of 5048	2008	Unicorn-62532.exe	90
PID 2008 wrote to memory of 5048	2008	Unicorn-62532.exe	90
PID 1924 wrote to memory of 2816	1924	Unicorn-48373.exe	91
PID 1924 wrote to memory of 2816	1924	Unicorn-48373.exe	91
PID 1924 wrote to memory of 2816	1924	Unicorn-48373.exe	91
PID 3216 wrote to memory of 1796	3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe	92
PID 3216 wrote to memory of 1796	3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe	92
PID 3216 wrote to memory of 1796	3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe	92
PID 5048 wrote to memory of 1760	5048	Unicorn-33671.exe	94
PID 5048 wrote to memory of 1760	5048	Unicorn-33671.exe	94
PID 5048 wrote to memory of 1760	5048	Unicorn-33671.exe	94
PID 2008 wrote to memory of 3564	2008	Unicorn-62532.exe	95
PID 2008 wrote to memory of 3564	2008	Unicorn-62532.exe	95
PID 2008 wrote to memory of 3564	2008	Unicorn-62532.exe	95
PID 1796 wrote to memory of 3308	1796	Unicorn-14734.exe	96
PID 1796 wrote to memory of 3308	1796	Unicorn-14734.exe	96
PID 1796 wrote to memory of 3308	1796	Unicorn-14734.exe	96
PID 2816 wrote to memory of 844	2816	Unicorn-53537.exe	97
PID 2816 wrote to memory of 844	2816	Unicorn-53537.exe	97
PID 2816 wrote to memory of 844	2816	Unicorn-53537.exe	97
PID 3216 wrote to memory of 3684	3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe	98
PID 3216 wrote to memory of 3684	3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe	98
PID 3216 wrote to memory of 3684	3216	c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe	98
PID 4456 wrote to memory of 4024	4456	Unicorn-30273.exe	99
PID 4456 wrote to memory of 4024	4456	Unicorn-30273.exe	99
PID 4456 wrote to memory of 4024	4456	Unicorn-30273.exe	99
PID 1924 wrote to memory of 2804	1924	Unicorn-48373.exe	100
PID 1924 wrote to memory of 2804	1924	Unicorn-48373.exe	100
PID 1924 wrote to memory of 2804	1924	Unicorn-48373.exe	100
PID 3940 wrote to memory of 2356	3940	Unicorn-2701.exe	101
PID 3940 wrote to memory of 2356	3940	Unicorn-2701.exe	101
PID 3940 wrote to memory of 2356	3940	Unicorn-2701.exe	101
PID 1760 wrote to memory of 4392	1760	Unicorn-65457.exe	104
PID 1760 wrote to memory of 4392	1760	Unicorn-65457.exe	104
PID 1760 wrote to memory of 4392	1760	Unicorn-65457.exe	104
PID 5048 wrote to memory of 4796	5048	Unicorn-33671.exe	105
PID 5048 wrote to memory of 4796	5048	Unicorn-33671.exe	105
PID 5048 wrote to memory of 4796	5048	Unicorn-33671.exe	105
PID 3564 wrote to memory of 712	3564	Unicorn-44060.exe	106
PID 3564 wrote to memory of 712	3564	Unicorn-44060.exe	106
PID 3564 wrote to memory of 712	3564	Unicorn-44060.exe	106
PID 2008 wrote to memory of 4764	2008	Unicorn-62532.exe	107
PID 2008 wrote to memory of 4764	2008	Unicorn-62532.exe	107
PID 2008 wrote to memory of 4764	2008	Unicorn-62532.exe	107
PID 3308 wrote to memory of 2168	3308	Unicorn-52878.exe	108
PID 3308 wrote to memory of 2168	3308	Unicorn-52878.exe	108
PID 3308 wrote to memory of 2168	3308	Unicorn-52878.exe	108
PID 1796 wrote to memory of 1292	1796	Unicorn-14734.exe	109
PID 1796 wrote to memory of 1292	1796	Unicorn-14734.exe	109
PID 1796 wrote to memory of 1292	1796	Unicorn-14734.exe	109
PID 3684 wrote to memory of 3296	3684	Unicorn-18679.exe	110

C:\Users\Admin\AppData\Local\Temp\c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe
"C:\Users\Admin\AppData\Local\Temp\c775c25ff2382896ef332159d7bf70428dd47d0f36b26124e40ceccae7573901N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30273.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55089.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1008.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        9⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1031.exe
        9⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        9⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61048.exe
        9⤵
        
        PID:17640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        8⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
        8⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51436.exe
        8⤵
        
        PID:15904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55064.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe
        8⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        8⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31355.exe
        8⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21271.exe
        8⤵
        
        PID:17472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        7⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        7⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28363.exe
        7⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
        7⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7760.exe
        7⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        8⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        8⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32123.exe
        8⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5319.exe
        8⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30158.exe
        7⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        7⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
        7⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51032.exe
        7⤵
        
        PID:17868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47951.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12395.exe
        7⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24549.exe
        7⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        7⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
        6⤵
        
        PID:8728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        6⤵
        
        PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41694.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12823.exe
        8⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe
        8⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24549.exe
        8⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        8⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12631.exe
        7⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe
        7⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        7⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51608.exe
        7⤵
        
        PID:17628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
        7⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60917.exe
        7⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32123.exe
        7⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54712.exe
        7⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34560.exe
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
        6⤵
        
        PID:16904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11598.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57153.exe
        6⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37797.exe
        7⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46047.exe
        7⤵
        
        PID:16700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        6⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48983.exe
        7⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64446.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38366.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21563.exe
        6⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43576.exe
        6⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22606.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
        5⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5484.exe
        5⤵
        
        PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17105.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
        8⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe
        8⤵
        
        PID:16824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37543.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe
        7⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46798.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        7⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        7⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        7⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        7⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18603.exe
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48999.exe
        6⤵
        
        PID:15032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        6⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23713.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        7⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32123.exe
        7⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        7⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12631.exe
        6⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30158.exe
        6⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        6⤵
        
        PID:17464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        6⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36492.exe
        6⤵
        
        PID:12916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36280.exe
        5⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25454.exe
        5⤵
        
        PID:13352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34503.exe
        5⤵
        
        PID:17832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        6⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34782.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
        8⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17278.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19296.exe
        8⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
        8⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        8⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15143.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        7⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
        7⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59400.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12637.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        7⤵
        
        PID:13960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34120.exe
        6⤵
        
        PID:13668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38901.exe
        6⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
        6⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30872.exe
        6⤵
        
        PID:16492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exe
        5⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
        5⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
        6⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
        6⤵
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9684.exe
        6⤵
        
        PID:16792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        5⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe
        5⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
      4⤵
      PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        5⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        5⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61624.exe
        5⤵
        
        PID:18380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe
      4⤵
      PID:9640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
      4⤵
      PID:13388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
      4⤵
      PID:17304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65457.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2736.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31118.exe
        8⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        9⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe
        9⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        9⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16045.exe
        9⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35111.exe
        8⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
        8⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        8⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46047.exe
        8⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24407.exe
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        9⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
        8⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        8⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        8⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10523.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48024.exe
        6⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50993.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        8⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
        8⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12260 -s 216
        9⤵
        Program crash
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5316.exe
        8⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        8⤵
        
        PID:18424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27623.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64249.exe
        7⤵
        
        PID:16632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29502.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47582.exe
        7⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
        7⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        7⤵
        
        PID:17428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        6⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe
        6⤵
        Executes dropped EXE
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43121.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        8⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        9⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        9⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        9⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        8⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe
        8⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe
        8⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11671.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51784.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exe
        7⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5620.exe
        7⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7895.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56913.exe
        7⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50446.exe
        8⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        8⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7783.exe
        7⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        7⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62127.exe
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6292.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23120.exe
        6⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47919.exe
        5⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25358.exe
        6⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34279.exe
        7⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45096.exe
        7⤵
        
        PID:16956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32065.exe
        7⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe
        7⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30350.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        6⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3735.exe
        6⤵
        
        PID:12176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27274.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52959.exe
        6⤵
        
        PID:18208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        5⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15777.exe
        5⤵
        
        PID:16448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22337.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54542.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44382.exe
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26462.exe
        8⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        8⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33419.exe
        8⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        8⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        7⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        7⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11952.exe
        7⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        7⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        6⤵
        
        PID:9752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1063.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
        6⤵
        
        PID:16912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
        5⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26529.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        8⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        8⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        8⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51022.exe
        7⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        6⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        6⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22827.exe
        6⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49303.exe
        6⤵
        
        PID:17476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29310.exe
        5⤵
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        6⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2414.exe
        6⤵
        
        PID:17856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41656.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24285.exe
        5⤵
        
        PID:16388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-363.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59633.exe
        5⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe
        7⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        7⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
        7⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31655.exe
        6⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8644.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        6⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65408.exe
        6⤵
        
        PID:16980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        5⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40193.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16511.exe
        6⤵
        
        PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        5⤵
        
        PID:13508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50618.exe
        5⤵
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20650.exe
        5⤵
        
        PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42648.exe
      4⤵
      PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        5⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        6⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34279.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        6⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41593.exe
        6⤵
        
        PID:17376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27431.exe
        5⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40706.exe
        6⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23998.exe
        5⤵
        
        PID:11592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        5⤵
        
        PID:15756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44703.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45727.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16270.exe
        5⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe
        6⤵
        
        PID:13744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43918.exe
        6⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        5⤵
        
        PID:12044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        5⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20120.exe
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
      4⤵
      PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe
      4⤵
      PID:12480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
      4⤵
      PID:17232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3008.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55201.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25742.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53249.exe
        8⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        8⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        8⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe
        8⤵
        
        PID:17920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30734.exe
        7⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        7⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57345.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        7⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17630.exe
        7⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2983.exe
        7⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        7⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5915.exe
        6⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        6⤵
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26779.exe
        6⤵
        
        PID:15644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe
        5⤵
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        7⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        7⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
        7⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe
        6⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21537.exe
        7⤵
        
        PID:17536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51061.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5102.exe
        6⤵
        
        PID:17624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52367.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        6⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22377.exe
        6⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48760.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27358.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe
        5⤵
        
        PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2663.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
        5⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        7⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        7⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        7⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65521.exe
        7⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5369.exe
        7⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56719.exe
        7⤵
        
        PID:18412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30158.exe
        6⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        6⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        6⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
        6⤵
        
        PID:18388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        5⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56913.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7783.exe
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        6⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7175.exe
        6⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe
        5⤵
        
        PID:9632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34120.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
        5⤵
        
        PID:16936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47535.exe
      4⤵
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46897.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22433.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8759.exe
        7⤵
        
        PID:13384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62252.exe
        7⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48696.exe
        6⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48718.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12631.exe
        5⤵
        
        PID:184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13814.exe
        6⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1156.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55806.exe
        5⤵
        
        PID:12828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
      4⤵
      PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31729.exe
        5⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
        6⤵
        
        PID:14376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36671.exe
        6⤵
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        5⤵
        
        PID:16156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48901.exe
        5⤵
        
        PID:15292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
      4⤵
      PID:9380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe
      4⤵
      PID:11688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19235.exe
      4⤵
      PID:15472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58415.exe
        6⤵
        
        PID:11548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
        6⤵
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe
        6⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63973.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        6⤵
        
        PID:17496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39215.exe
        5⤵
        
        PID:14464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21639.exe
        5⤵
        
        PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41412.exe
      4⤵
      PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        5⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        6⤵
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24297.exe
        6⤵
        
        PID:16568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
        5⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
        5⤵
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2414.exe
        5⤵
        
        PID:17912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59983.exe
      4⤵
      PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11952.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15671.exe
        5⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49760.exe
        5⤵
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41384.exe
      4⤵
      PID:11036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
      4⤵
      PID:13532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-73.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-73.exe
      4⤵
      PID:15712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
      4⤵
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29966.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        6⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
        6⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
        6⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11671.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
        5⤵
        
        PID:16160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        5⤵
        
        PID:16948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14256.exe
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        5⤵
        
        PID:14944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33918.exe
        5⤵
        
        PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39656.exe
      4⤵
      PID:10828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe
      4⤵
      PID:13932
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13932 -s 464
        5⤵
        Program crash
        
        PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6784.exe
      4⤵
      PID:8080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35812.exe
    3⤵
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
      4⤵
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        5⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        5⤵
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
      4⤵
      PID:7948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30158.exe
      4⤵
      PID:11880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58684.exe
      4⤵
      PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43761.exe
    3⤵
    PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
      4⤵
      PID:8344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
      4⤵
      PID:12600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
      4⤵
      PID:16220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
      4⤵
      PID:17316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60998.exe
    3⤵
    PID:8384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40815.exe
    3⤵
    PID:12700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exe
    3⤵
    PID:16616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48373.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48373.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55281.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17921.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        8⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27889.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        9⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58697.exe
        9⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24375.exe
        8⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15566.exe
        8⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        8⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        8⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        8⤵
        
        PID:12624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37361.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27800.exe
        8⤵
        
        PID:17904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22158.exe
        7⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        7⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        7⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12295.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63793.exe
        8⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        8⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        7⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
        7⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17965.exe
        7⤵
        
        PID:17352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32126.exe
        6⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37697.exe
        7⤵
        
        PID:17088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29480.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        6⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51032.exe
        6⤵
        
        PID:17948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14416.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
        8⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
        8⤵
        
        PID:16556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1415.exe
        7⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        7⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28786.exe
        7⤵
        
        PID:17152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51640.exe
        6⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        7⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
        7⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        7⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28030.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17428.exe
        6⤵
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        6⤵
        
        PID:8960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37567.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        6⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        6⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48801.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        6⤵
        
        PID:15800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        5⤵
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1584.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2368.exe
        6⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe
        7⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12884.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7764.exe
        7⤵
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2734.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        6⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50988.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32679.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        6⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        6⤵
        
        PID:17616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10139.exe
        5⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
        5⤵
        
        PID:7932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45340.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-166.exe
        7⤵
        
        PID:16744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32315.exe
        6⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2314.exe
        6⤵
        
        PID:17244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5620.exe
        5⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9115.exe
        5⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11262.exe
        5⤵
        
        PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3271.exe
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56913.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
        5⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        5⤵
        
        PID:14988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
      4⤵
      PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1799.exe
      4⤵
      PID:13116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe
      4⤵
      PID:16864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48965.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22993.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50977.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55518.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7248.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
        8⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
        8⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38695.exe
        7⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
        7⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        7⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8759.exe
        7⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe
        7⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        7⤵
        
        PID:18232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8663.exe
        6⤵
        
        PID:15004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        6⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10375.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43841.exe
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        7⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        7⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8423.exe
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29406.exe
        6⤵
        
        PID:13864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54857.exe
        6⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51192.exe
        5⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39215.exe
        5⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35847.exe
        5⤵
        
        PID:18400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63400.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1792.exe
        5⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        6⤵
        
        PID:7232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 628
        6⤵
        Program crash
        
        PID:10404
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 636
        5⤵
        Program crash
        
        PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46031.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
        5⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10818.exe
        6⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe
        6⤵
        
        PID:17820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        5⤵
        
        PID:12532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54256.exe
        5⤵
        
        PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25128.exe
      4⤵
      PID:8428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
      4⤵
      PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
        5⤵
        
        PID:16508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
      4⤵
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        6⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
        7⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe
        7⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4414.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1812.exe
        6⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9239.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12144.exe
        6⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
        7⤵
        
        PID:17416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33268.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe
        6⤵
        
        PID:17328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        5⤵
        
        PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        5⤵
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
        5⤵
        
        PID:16400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
      4⤵
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51422.exe
        5⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25889.exe
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27783.exe
        6⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        6⤵
        
        PID:16196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28786.exe
        6⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37543.exe
        5⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26334.exe
        5⤵
        
        PID:14676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55625.exe
        5⤵
        
        PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45183.exe
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64165.exe
        5⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        5⤵
        
        PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25240.exe
      4⤵
      PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10825.exe
      4⤵
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10406.exe
      4⤵
      PID:16756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
      4⤵
      PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        6⤵
        
        PID:13080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        6⤵
        
        PID:17268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        5⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4414.exe
        5⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43226.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2030.exe
        5⤵
        
        PID:17932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59509.exe
      4⤵
      PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        5⤵
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41406.exe
        5⤵
        
        PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14462.exe
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18025.exe
      4⤵
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
      4⤵
      PID:18080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5150.exe
    3⤵
    PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
      4⤵
      PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40753.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13984.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61484.exe
        6⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        5⤵
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
        5⤵
        
        PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55797.exe
      4⤵
      PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4414.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
      4⤵
      PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
    3⤵
    PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17137.exe
      4⤵
      PID:10252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52568.exe
      4⤵
      PID:14160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8644.exe
      4⤵
      PID:7664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
    3⤵
    PID:9848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36934.exe
    3⤵
    PID:13432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
    3⤵
    PID:7864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43406.exe
        6⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        7⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
        8⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        8⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61484.exe
        8⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5915.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8528.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2879.exe
        7⤵
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18071.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58415.exe
        7⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        7⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe
        6⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        5⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50817.exe
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
        7⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        6⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
        6⤵
        
        PID:18220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22974.exe
        5⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        6⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47649.exe
        6⤵
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18541.exe
        6⤵
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4375.exe
        5⤵
        
        PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57935.exe
        5⤵
        
        PID:13464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
        5⤵
        
        PID:16808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        6⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45345.exe
        7⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62366.exe
        7⤵
        
        PID:16592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30331.exe
        7⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2292.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        6⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43176.exe
        6⤵
        
        PID:17796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39921.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        5⤵
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39796.exe
        5⤵
        
        PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5454.exe
      4⤵
      PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35166.exe
        5⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        6⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        5⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53130.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7380.exe
        5⤵
        
        PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
      4⤵
      PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26929.exe
        5⤵
        
        PID:9284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58300.exe
        5⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe
        5⤵
        
        PID:17940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
      4⤵
      PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41399.exe
      4⤵
      PID:13416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
      4⤵
      PID:17436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61301.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31355.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        7⤵
        
        PID:16812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28775.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30158.exe
        6⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        6⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
        6⤵
        
        PID:18356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17220.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
        6⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25688.exe
        6⤵
        
        PID:17452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25598.exe
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
        5⤵
        
        PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
      4⤵
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57537.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25934.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
        5⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30734.exe
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        5⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        5⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2599.exe
        5⤵
        
        PID:17844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48527.exe
      4⤵
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25969.exe
        5⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        5⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12171.exe
        5⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27800.exe
        5⤵
        
        PID:17520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
      4⤵
      PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
      4⤵
      PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17945.exe
      4⤵
      PID:15660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35423.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 720
      4⤵
      Program crash
      PID:5484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
    3⤵
    PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57537.exe
      4⤵
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36958.exe
        6⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
        6⤵
        
        PID:15348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4254.exe
        6⤵
        
        PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45772.exe
        5⤵
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
      4⤵
      PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64284.exe
      4⤵
      PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
      4⤵
      PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37790.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
    3⤵
    PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13856.exe
      4⤵
      PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12395.exe
      4⤵
      PID:12372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30623.exe
      4⤵
      PID:3856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65464.exe
    3⤵
    PID:8568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe
    3⤵
    PID:11752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
    3⤵
    PID:10172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24703.exe
    3⤵
    PID:7432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26753.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe
        5⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35166.exe
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
        7⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55688.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3662.exe
        5⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18014.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8452.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6599.exe
        5⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14472.exe
        5⤵
        
        PID:16840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10167.exe
      4⤵
      PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10016.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
        6⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44076.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe
        6⤵
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48776.exe
        5⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
        5⤵
        
        PID:13492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        5⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57951.exe
      4⤵
      PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        5⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        5⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1812.exe
        5⤵
        
        PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
      4⤵
      PID:12608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17207.exe
      4⤵
      PID:16836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
      4⤵
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        5⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        6⤵
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34181.exe
        6⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        6⤵
        
        PID:17508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32055.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
        5⤵
        
        PID:13456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
        5⤵
        
        PID:16924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44216.exe
      4⤵
      PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45009.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15671.exe
        5⤵
        
        PID:13856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9604.exe
        5⤵
        
        PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56092.exe
      4⤵
      PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41137.exe
        5⤵
        
        PID:18244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
      4⤵
      PID:13884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8148.exe
      4⤵
      PID:16424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6606.exe
    3⤵
    PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53726.exe
      4⤵
      PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        5⤵
        
        PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        5⤵
        
        PID:13288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11271.exe
        5⤵
        
        PID:17540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exe
      4⤵
      PID:9272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
      4⤵
      PID:16652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2807.exe
    3⤵
    PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
      4⤵
      PID:9048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
      4⤵
      PID:12568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4416.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40825.exe
      4⤵
      PID:13056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3214.exe
    3⤵
    PID:9332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
    3⤵
    PID:13796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33842.exe
    3⤵
    PID:16776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31659.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31659.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        6⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31137.exe
        7⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52591.exe
        6⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10553.exe
        6⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
        6⤵
        
        PID:17808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64737.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51416.exe
        5⤵
        
        PID:17960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
      4⤵
      PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        5⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21408.exe
        5⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12231.exe
        5⤵
        
        PID:18368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23045.exe
      4⤵
      PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe
      4⤵
      PID:14236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14856.exe
      4⤵
      PID:16472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
    3⤵
    PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11424.exe
      4⤵
      PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47873.exe
        5⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe
      4⤵
      PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
      4⤵
      PID:13192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
      4⤵
      PID:756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58693.exe
      4⤵
      PID:17296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
    3⤵
    PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
      4⤵
      PID:8380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56216.exe
      4⤵
      PID:12404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12480.exe
      4⤵
      PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
      4⤵
      PID:17404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19358.exe
    3⤵
    PID:9200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
    3⤵
    PID:13920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
    3⤵
    PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50353.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45009.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        5⤵
        
        PID:14520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51022.exe
        5⤵
        
        PID:17256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
      4⤵
      PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11433.exe
      4⤵
      PID:8356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
    3⤵
    PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
      4⤵
      PID:13256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe
      4⤵
      PID:2216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2270.exe
    3⤵
    PID:11060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32200.exe
    3⤵
    PID:14688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23332.exe
    3⤵
    PID:6332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5680.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5680.exe
  2⤵
  PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31710.exe
    3⤵
    PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
      4⤵
      PID:13404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
      4⤵
      PID:16496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-727.exe
    3⤵
    PID:9948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60735.exe
    3⤵
    PID:13704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14893.exe
    3⤵
    PID:5972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51174.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51174.exe
  2⤵
  PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
    3⤵
    PID:9928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
    3⤵
    PID:12844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36927.exe
    3⤵
    PID:17220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe
  2⤵
  PID:10900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
  2⤵
  PID:13836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3829.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3829.exe
  2⤵
  PID:6436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1720 -ip 1720
1⤵
PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2092 -ip 2092
1⤵
PID:7072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6088 -ip 6088
1⤵
PID:11192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 12260 -ip 12260
1⤵
PID:12752

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:16272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe

Filesize
468KB

MD5
5a46f205e4a5b57ec8c56eb41b15eeb3

SHA1
d4aaeca8cfd2274c2eced84b3988713f94c1332f

SHA256
3d6cce3d7c0b3daec4fbdfa7cc483052973ac024d8500a1f0af5b54d4f7b9a05

SHA512
8728dc05ab5d6d39cedbc9a89d8f4e9e89808bc058a18764af4dc9d1a74000f195f12b1f3afa24d73e9989f336533149fe86c2c2d047bcb736ceefeec52161cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe

Filesize
468KB

MD5
776d2c0d8fde6db65a0b40c9ceb089d2

SHA1
9b2c1b683abc329268712771244cdca1b8093217

SHA256
426596548b66ac84a22d7700961458bc06def18265e45a286ad4f40376ccb892

SHA512
c49f4e10a3a542d8d57f3380b4f730559b695d5d8b92dd476eb23acd9285681910dfb26882b4ff0be3a981ce8a045e5b7745a93133a2a361b9aa08de0bdf7e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe

Filesize
468KB

MD5
d2a32696b9e36bfffb332362c9ae1796

SHA1
9c9044d28d4c09681128f1dc2b946e6e6d6967dc

SHA256
63bf779d5da41228ca8d6ace204d60ce7bc1a3d898ee80a42d6205612cd3c476

SHA512
7cb63f7bf5b3bb41a256a466e5ea35ebcae25d3b6470ed73d88bc602ef3df978a7463003c991f1a7ddc75a6e2955b6bca0597bfdc33c00eee1373c36739f8385

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe

Filesize
468KB

MD5
7a7f0b8e3c1454b5fcf6f87a57c6ed2c

SHA1
e85a0511f85f1424a3ec007b8a63173577b0e086

SHA256
4dbe42388e878fdb1149debe5e74676dbce0517fade02ab7b4f65c3c10a21830

SHA512
a2fdff3ac0b03fb6a4639260b47ea517322b971993a8668c0e80c9a514ab64a24c591b6b1283ad86db0942d118eae331c00267e55dfc5a0a6de1d4bae4364099

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19956.exe

Filesize
468KB

MD5
fe9b94f1501ef1ddcd894bb9856cedc5

SHA1
e3bd7229319f83170881c87cd2129ea6247f6a87

SHA256
8537db46957b2e6b28524de5594990f6e3d24ab1b4ed7ccf5e697e8f634db0da

SHA512
a449b44ba7420df830ead6bed1f205861fed97e36ef45e2791c6b1f3b69682a39d5a9a31146504d56d6b1f4b704fe9081d01f5663da8a1589dbb009b2a191f82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22993.exe

Filesize
468KB

MD5
3114c4eea82167a1eeef573d4dbb3ba9

SHA1
05ddfe7f7d61afc457893d5424aca7628bf3c9f0

SHA256
1bcec3a60167fecd9fc4f31f5f04c415ca5e351f17f1798bccaaaf421d07d4ed

SHA512
98997726ee837cc7b4cfce626dc98b3764ab51fb7687a9df73c6b79fb2673e501ded68fcc160647b6f95f626658bd47191fefeda8fa6ce9d2f2f9c8766436f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe

Filesize
468KB

MD5
eefc8d2f8e12f54af4ed48a33dbca3e2

SHA1
160f1cb940fbcbb18f3707cecc15689f69ff7a86

SHA256
36626eded620fe05ee9b0431bbd7d90503e7caad17ab6d320b946cbc8ccb33a3

SHA512
25836dff05e81092953b5708d950fdccca505b20d392d6f14c611e9c271b9bf373e42d6170598c8b9e78878acbd0552ea768af2a616eb5c3bd55e56cbed56e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe

Filesize
468KB

MD5
21329bc3141bedd2b342ff3654a3a4f3

SHA1
efed02c6f10995b440a8373f7766c1d643557512

SHA256
9d5c2b3bca98005b8d32b9eee5b2d25e23f545c5766afef24fc7ddddf10db723

SHA512
74dc84f8c89db37eba44a1881747a49c3b89071fc3ad54cefa4ee1799745bbfe859ccfaf0f0cb5812998e5885dd83b2e8efa832c766713c318971bd4696977af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3008.exe

Filesize
468KB

MD5
161d36c596209d7d11bb9972a5a12ac6

SHA1
db714e9277c077fc26eff4a28843cb24667084b6

SHA256
80c108110bf19a449659bb0fb2ae3c4a683aa490d0c41391effaa95bb1b15481

SHA512
b90438df14eae2f688a04104fe005cb390574fd74241a6daa6d95dcb62528be1289bc473f1a005a5f0d0a998597354a14ef88899e6087e2fb1b9ce56c938a22c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30273.exe

Filesize
468KB

MD5
aa82ce7465f3962d1df65feee79105f6

SHA1
e5b1627514cd4b8c981e81f488452688e4f51498

SHA256
0bf0dbda7c6c86e148f4224a98076cf549d7d3397ddf6cba48c315f04891985e

SHA512
e115e8d733f251a9bb0a17372a155e9ad1abd8ebd3ff65e1a0ae2161ddfc789cb684e3799c7999f0e8c611be861cf091cfa87be9600d2315b1942f5f44ccf786

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31659.exe

Filesize
468KB

MD5
8bc754714c30ad27d41856e78d62f507

SHA1
d8c48ce1725dd2ffaaae57a4cc5274d7b90c1a0d

SHA256
44ea3ef4de6d0ac4d6e50c30e5771649ed41c89b083ad37585bd152a78dfb0cc

SHA512
8b632dcdd1636e950057c7003d8b57a2f4237733b90f98aa01ae8291cf021117513d8a8e8ef06be3557c83d5a599ede2c16360e9ff70c58d93bd48b1a3006e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe

Filesize
468KB

MD5
f356fd88a081062b44c3aea35781e103

SHA1
5a48de21849f4f4f40da3b14da000986c93f0911

SHA256
ced9f857a0dd265120f27e67b1ef8899e854d347cd3af0df1bfda1bd89e389f2

SHA512
6ddc8e482e584a0082289ebaacd803cd84964eb101c579ef9c10a55f9bd40c592f0ea826fcb9ccb528dcc7f3f191652c5cfd04155f5d74a02b7ecfb3423bdff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe

Filesize
468KB

MD5
8878527b30fcb03c67bd33abeac4bef8

SHA1
378c0c72ae3625ec1cd01b58062d0c59d7f4baf5

SHA256
aff9b71cda0a7476a9706739c28ffd5ce9434e45b6ccedbda25a59c14b60526b

SHA512
eab28c58ec9796b106e347fef9d67b7e1f2467605439c38445db9d774fb28f9a680d9be978f84d3628920a137666c7a4c2ca60473e26802f142e0819be038497

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe

Filesize
468KB

MD5
f274f2cf049ad091f283907bef154157

SHA1
8d1f51661db2a6c0d491dae97227a6a5d39d1ac3

SHA256
80aea00a6bd9d1a4b5b81bf01e4758acc844558bc5b4182f08118a3709dcb5db

SHA512
c00251a46bc6cb39e0a9e3d71334e7192cc0a19ba71bfec8fd64691aefc1f689ac8d2e6a8258380c257086a6eeb1ad6f06b19b2e0228ac252ffdf2028c96838c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe

Filesize
468KB

MD5
d2fb69ee26ecad2d80ccb09cc832ff9d

SHA1
8b45baa473eb0cea8f48e93736c57cb588708815

SHA256
83c35e7194bfa953eb97127d10328a51ff4ce835d1727bbf05a126027feadff8

SHA512
1e50345e647034c33d61721e30b6e7b0a163993705ac46570207e6616644a710b29da26946be71e06be218ce5514c388dda52e6be38f0be58c70eb63078b4814

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe

Filesize
468KB

MD5
642099c71bd16b2850aa91df15f7255d

SHA1
c9100977c78dad6f822ce8c898d26118b89c61a2

SHA256
506accfec658db5a20700e53f6591676c58c6c4926981509a15425a464c4e9f9

SHA512
890340dead0d07a88d9d4bd966ee1cfe6988296d184b064a7186ff47b494ecda84f6d4230e19b98748360e5da8390671483bbd0a82976bf5a494dddaed8cdddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe

Filesize
468KB

MD5
9523a621062c53f944b238a68163d2b5

SHA1
b9db91e418d91747ce56c35749b62ddbee2d993a

SHA256
95a60d9bc621418592a99330e90b8adf64c1ab9bf69db771475effe64743a7ca

SHA512
b10e4f82c2de41d8e1606c21ee255cc8f4a23c55efca691b26fff6d47ce564efbc09c0e87698f3c4a05771fa398851b09ac5d23471080d723f85b18d3da1339c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38670.exe

Filesize
468KB

MD5
2f6f2221551b0c0135dce42e6578164c

SHA1
17169c951b3575d32f54e7f1bb0ec36801600d39

SHA256
c38ea7da85a3178da9071d8c5098db0df2b760859ca53352c7c79d0213a11366

SHA512
79b2a0923c2442f7e51d493d8f8f22da5a0a06e1648dee13aab97e91ae736821a1651af394b48393f9ee630d3cc2aae0fdfab9334e1709fc03b901103a30a806

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe

Filesize
468KB

MD5
88065e2a650392381ab1b4e574a6ed9e

SHA1
00a6490a9f2eae0fde5089b57fec133fea6506dc

SHA256
ea7db5f647eef61533ea6a08e33d40e684de11d533e1be7fcccae9bb85286cc5

SHA512
d028f8ce89d5edc38d4133f5fa893fc3d020cf7e9f981dccd40c3a23926bc03ba2e7e7ce88a300bff5c59f4271e8411556ce62abf94462f3dc18397cef684db5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe

Filesize
468KB

MD5
dd3fd14f5a3554f824889db0392ce1dc

SHA1
5d7de865e14b2c10969957ee1609c8273c38d88f

SHA256
b2cf75e492bcf32c2e96321dae6c9341c9f8c80f68aa4fc11d0da7917e53a658

SHA512
797023b42d3f1c1d12fd6979775b3a4ac812695393fc971dcaa97148943bcb84f5b2b3d5d7fa138e80ca76e96c8d15a07eb0e39d4c25208765e444504329c818

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48373.exe

Filesize
468KB

MD5
ec7f2a7ebee0bde6f0a88cd27df5d07f

SHA1
afbd0e689c89ab099341f0bfec8c55bb7096c1b3

SHA256
423cc6374a1fd97e3a446dfc445f9bccc6c17b76a2e529d891d04302e3b65c65

SHA512
d791c5955bb87e365a2f7c65742dfed6ce83f842b4ff0db35d4453f029298c2112bcdedb4074bd24be4af3221da9cc89e9e80330474b1e1aa015c1ea78cb5fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe

Filesize
468KB

MD5
c70d6a0d53143090e4a3d35f694d749d

SHA1
0fbd8f1d71e489ec47648d093cca6e12f6677df0

SHA256
780e9112cb4f149e32d51234d9e77efc4779822a00b0f07a67555bb3e66e5c96

SHA512
a307f16efd1b4d19828afe776ea115ae426cd0c53a9f28ea9dc4b3577e248b19194262e91ed9c0c5e6a0188cd3777458f63e2fdc398a6a5c22bffc0685e39dc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48965.exe

Filesize
468KB

MD5
fecacda2a24b85c42f9dd8e085135752

SHA1
edd5129a27436c0676351c1f985822efa1658b58

SHA256
773671e3e34288b9e7cc335cc4f986e917944843ec311d97141cbc3cdb1a61f6

SHA512
824400a178cc0b7378bb7061e21750516c4ca032d01dee579055c57fc1d4b1a7995bb601e1579e6115885be447b2c7369370f5fe2863ba51e63180acd3b1991e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51617.exe

Filesize
468KB

MD5
84fc3ea0697a7d404918f93eccd685cd

SHA1
8424d77b2618707286474d3ca5b59726f96bbed1

SHA256
cdc2325500129591e7c17d91366f2317fb65d6173483ca622e49c8de38caf0d3

SHA512
d031ea69945bc4802c2547390c0d3fd41f97fb4e78c4ac34b39c690b58e73137fb6ce8337c232fc39ae9ce0cd8fdcce410a557dc76e2e08b52c2ddde869e6da6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe

Filesize
468KB

MD5
4f384a349c1df1adbf66fdcc533053f1

SHA1
71d76ed2c6d482a91ccdfdf325686a679729fba8

SHA256
6656183ab9fc64f2bf6462dad47fb6e958d36e44ef4471d5b1ef0501726bdff7

SHA512
abb22a2193d1390d59a7d6622876996d7ba924a94a07a7b55801d71445908b33626304b76c6eac822cd069c9960714922fe6b521ce024419cb2e71c261915da2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe

Filesize
468KB

MD5
a08e436543889d93dd630bfd9223142b

SHA1
f12a2b3fa8bce1b40db2ecba84c9cbc77dc4214f

SHA256
220dd307c8305e47550c0053f6cd31547bd319266d7c6efea58a3fe153895059

SHA512
dd2f155f7148589a7b38a1c8b094ca9d4c37e3c3c108481c6b3fe1833f0af69bb118fd4269ebea5741c84d73ce1d78a89a5baaa1e873dafb8771735f35993d99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe

Filesize
468KB

MD5
e0370f15f4567ccab0779b8c64aa599b

SHA1
b450977995170a3c93afefd7022d05a8bb3cade3

SHA256
e043ff95c9fdf12f9db6c1997a15333ad20562f4e49ce76fdc7eeb46bbbf655d

SHA512
31b0b5f458aa64805719dca2f1e49ca733582cb16a1a563725f98fc8624bce67c1b3a80a5acb6ab3ee6f21a52b2cbf3c7e287d6f15d8dbdfec8325c8306e9af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55089.exe

Filesize
468KB

MD5
ed7a32e88901a95ad1a01edca8e3f641

SHA1
5e7d1517d59b6b04f012ea87a9913afa8160f24d

SHA256
ac3d15d87d942059d01a6530c7476f1d39bb40aa3eb502ca7a6406d95c2f5678

SHA512
6f1d38925312c04a0f5716f7e483a1db8fb0a9cf7bd39220148f4700abecee1a88d61a19e33b80c0ba94e5b94b34ccdb9d2c84bc1b0edc17ab804379599b021b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55281.exe

Filesize
468KB

MD5
6cea53f81843a0b838d642250c833353

SHA1
94b16f905596a08ec614cda667ea54ffb71086fa

SHA256
886c96ac27d7008e172deaaa62183c1b841a40c07d4e99217abc73d56d200c03

SHA512
9d610ba44a8204cbfd595d2def4d561c9abc06f2d87009d6946848ac02a845441e7eb5034483c53f3b7c3dc1236ebe22e696da8960a632739fa22c594e2a0f08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe

Filesize
468KB

MD5
1f782e1176300a109202fd28ed0385e5

SHA1
4db165bf578b12f2dbe596a557c15315f0b71ffb

SHA256
af74dffbef0388587d9d7be6799b7a16b6d358f7e4cb9b587bb8ad0cda31692f

SHA512
cfb670020f2b696170313db14a81e9b1ae0cb27b69af6bcb171429ba264f2b05685790053f0756785ef67779eda758380ae272bea1e9cf71e6ad00549f57857c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe

Filesize
468KB

MD5
b8fe00b142027cbfd9fbf67654ff0145

SHA1
6007dc81ac4de07bdd216ebc6db79b8e32a6344e

SHA256
e8322daee25ccd85e27aa9592a5be1f0f781f99a0e15e3409be2aed83e9b9cc4

SHA512
3eec78c562c4539326629b9f10f0ebd2155780e41364c926a4bf4318e3935b61edfffe66b4ccfd01c8c7321b4d87dc6871f7251a2bc2ac598c59d78ef0fc1b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65457.exe

Filesize
468KB

MD5
e31e2ac7e9598e2375c2c9be50d74805

SHA1
9fa1ab0e91675f13df658809f7c7e2d5142f5ea7

SHA256
4a06ec3a0e58d7a1622933a13337fbb6e8c690ed6b555b186a2b1c8a68e672ec

SHA512
453cc7c532cddde2b5f431b245b6c0cd43f48ffdcafaece4e2ddaba6adef8e3d4e74c64007e169a7e13b5bb4b0f50d9e8c31991ef4be2b16fd7938a73abdd404

Download Submit
memory/380-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/656-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/712-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/728-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/844-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/884-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/952-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1012-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1216-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1292-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1316-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1440-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1720-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-2567-0x0000000074BA0000-0x0000000074C34000-memory.dmp

Filesize
592KB

Download
memory/1796-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1832-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2092-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2096-3567-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2252-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3104-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3216-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3220-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3228-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3296-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3472-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3564-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3576-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3592-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3684-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3764-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3868-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4024-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4180-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4248-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4384-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4392-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4456-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4500-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4580-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4692-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4716-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4764-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4864-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4916-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5068-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5180-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5276-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5284-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5296-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5440-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5580-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5600-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5656-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15852-2524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads