00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe
Size

468KB
MD5

5b06682d2a9233f07ab74455c18925c0
SHA1

12d93ace049506e747fd7f07e6b809ec1f4176f3
SHA256

00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06
SHA512

70249952f3d0cf1fd6126f672b0524cc1f8d82c6116cfed39b9e6dd238fe5b66b0586156b62e678b3cc7a948b1afe471325b888a0e3c35667320c6abccaa0e69
SSDEEP

3072:lqkCo3cOIV3KtbYVPzyxHfT/JHUXtIpvV1HCL4LhvBfpuO7YSMlT:lqxoC9KtuPWxHf+0iGvBRF7YS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
376	Unicorn-9818.exe
1720	Unicorn-55755.exe
2112	Unicorn-19553.exe
4464	Unicorn-55771.exe
3488	Unicorn-49833.exe
1128	Unicorn-42123.exe
1300	Unicorn-54930.exe
1120	Unicorn-41947.exe
3436	Unicorn-56015.exe
1220	Unicorn-10343.exe
3992	Unicorn-11697.exe
3560	Unicorn-60971.exe
4848	Unicorn-11962.exe
2988	Unicorn-8625.exe
2368	Unicorn-22360.exe
4956	Unicorn-41563.exe
3128	Unicorn-21889.exe
1448	Unicorn-63291.exe
3124	Unicorn-58230.exe
2580	Unicorn-47448.exe
1172	Unicorn-63976.exe
3112	Unicorn-43726.exe
4352	Unicorn-16011.exe
684	Unicorn-63592.exe
2016	Unicorn-12481.exe
4932	Unicorn-59273.exe
4592	Unicorn-16011.exe
4212	Unicorn-32082.exe
3260	Unicorn-22840.exe
3532	Unicorn-58203.exe
4108	Unicorn-38529.exe
2856	Unicorn-58395.exe
2204	Unicorn-2488.exe
2440	Unicorn-21621.exe
3988	Unicorn-29563.exe
3240	Unicorn-25649.exe
1776	Unicorn-45515.exe
4908	Unicorn-47762.exe
2700	Unicorn-2090.exe
4360	Unicorn-50258.exe
4896	Unicorn-33803.exe
380	Unicorn-44201.exe
4268	Unicorn-20347.exe
4272	Unicorn-16241.exe
1964	Unicorn-52443.exe
3788	Unicorn-20456.exe
4232	Unicorn-419.exe
3852	Unicorn-62265.exe
2984	Unicorn-20456.exe
3060	Unicorn-2858.exe
1408	Unicorn-64674.exe
2496	Unicorn-48146.exe
4396	Unicorn-2474.exe
2576	Unicorn-18161.exe
1928	Unicorn-19195.exe
2108	Unicorn-42937.exe
4304	Unicorn-12753.exe
1868	Unicorn-21617.exe
1924	Unicorn-28235.exe
2960	Unicorn-11322.exe
4316	Unicorn-56994.exe
2032	Unicorn-43922.exe
2460	Unicorn-44187.exe
4868	Unicorn-14010.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
876	3992	WerFault.exe	105
9900	6424	WerFault.exe	289
11956	6844	WerFault.exe	293
15748	14088	WerFault.exe	670
16288	12812	WerFault.exe	601

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11244.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15940	dwm.exe
Token: SeChangeNotifyPrivilege	15940	dwm.exe
Token: 33	15940	dwm.exe
Token: SeIncBasePriorityPrivilege	15940	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe
376	Unicorn-9818.exe
2112	Unicorn-19553.exe
1720	Unicorn-55755.exe
3488	Unicorn-49833.exe
1128	Unicorn-42123.exe
4464	Unicorn-55771.exe
1300	Unicorn-54930.exe
1120	Unicorn-41947.exe
3436	Unicorn-56015.exe
1220	Unicorn-10343.exe
4848	Unicorn-11962.exe
3560	Unicorn-60971.exe
2988	Unicorn-8625.exe
3992	Unicorn-11697.exe
2368	Unicorn-22360.exe
4956	Unicorn-41563.exe
3128	Unicorn-21889.exe
1448	Unicorn-63291.exe
3124	Unicorn-58230.exe
2580	Unicorn-47448.exe
1172	Unicorn-63976.exe
3112	Unicorn-43726.exe
4212	Unicorn-32082.exe
4352	Unicorn-16011.exe
4592	Unicorn-16011.exe
684	Unicorn-63592.exe
2016	Unicorn-12481.exe
4932	Unicorn-59273.exe
3260	Unicorn-22840.exe
3532	Unicorn-58203.exe
4108	Unicorn-38529.exe
2204	Unicorn-2488.exe
2856	Unicorn-58395.exe
2440	Unicorn-21621.exe
1776	Unicorn-45515.exe
3240	Unicorn-25649.exe
2700	Unicorn-2090.exe
4908	Unicorn-47762.exe
4360	Unicorn-50258.exe
4896	Unicorn-33803.exe
380	Unicorn-44201.exe
1964	Unicorn-52443.exe
4272	Unicorn-16241.exe
4268	Unicorn-20347.exe
3788	Unicorn-20456.exe
2984	Unicorn-20456.exe
1408	Unicorn-64674.exe
2496	Unicorn-48146.exe
4396	Unicorn-2474.exe
3060	Unicorn-2858.exe
3852	Unicorn-62265.exe
4232	Unicorn-419.exe
2576	Unicorn-18161.exe
1928	Unicorn-19195.exe
4304	Unicorn-12753.exe
2108	Unicorn-42937.exe
1868	Unicorn-21617.exe
1924	Unicorn-28235.exe
2960	Unicorn-11322.exe
4316	Unicorn-56994.exe
2776	Unicorn-26433.exe
2460	Unicorn-44187.exe
4868	Unicorn-14010.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 376	1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe	89
PID 1480 wrote to memory of 376	1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe	89
PID 1480 wrote to memory of 376	1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe	89
PID 376 wrote to memory of 1720	376	Unicorn-9818.exe	92
PID 376 wrote to memory of 1720	376	Unicorn-9818.exe	92
PID 376 wrote to memory of 1720	376	Unicorn-9818.exe	92
PID 1480 wrote to memory of 2112	1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe	93
PID 1480 wrote to memory of 2112	1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe	93
PID 1480 wrote to memory of 2112	1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe	93
PID 2112 wrote to memory of 4464	2112	Unicorn-19553.exe	95
PID 2112 wrote to memory of 4464	2112	Unicorn-19553.exe	95
PID 2112 wrote to memory of 4464	2112	Unicorn-19553.exe	95
PID 1480 wrote to memory of 3488	1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe	96
PID 1480 wrote to memory of 3488	1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe	96
PID 1480 wrote to memory of 3488	1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe	96
PID 1720 wrote to memory of 1128	1720	Unicorn-55755.exe	97
PID 1720 wrote to memory of 1128	1720	Unicorn-55755.exe	97
PID 1720 wrote to memory of 1128	1720	Unicorn-55755.exe	97
PID 376 wrote to memory of 1300	376	Unicorn-9818.exe	98
PID 376 wrote to memory of 1300	376	Unicorn-9818.exe	98
PID 376 wrote to memory of 1300	376	Unicorn-9818.exe	98
PID 1128 wrote to memory of 1120	1128	Unicorn-42123.exe	101
PID 1128 wrote to memory of 1120	1128	Unicorn-42123.exe	101
PID 1128 wrote to memory of 1120	1128	Unicorn-42123.exe	101
PID 3488 wrote to memory of 1220	3488	Unicorn-49833.exe	103
PID 3488 wrote to memory of 1220	3488	Unicorn-49833.exe	103
PID 3488 wrote to memory of 1220	3488	Unicorn-49833.exe	103
PID 1720 wrote to memory of 3436	1720	Unicorn-55755.exe	102
PID 1720 wrote to memory of 3436	1720	Unicorn-55755.exe	102
PID 1720 wrote to memory of 3436	1720	Unicorn-55755.exe	102
PID 1480 wrote to memory of 3992	1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe	105
PID 1480 wrote to memory of 3992	1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe	105
PID 1480 wrote to memory of 3992	1480	00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe	105
PID 4464 wrote to memory of 3560	4464	Unicorn-55771.exe	106
PID 4464 wrote to memory of 3560	4464	Unicorn-55771.exe	106
PID 4464 wrote to memory of 3560	4464	Unicorn-55771.exe	106
PID 1300 wrote to memory of 4848	1300	Unicorn-54930.exe	104
PID 1300 wrote to memory of 4848	1300	Unicorn-54930.exe	104
PID 1300 wrote to memory of 4848	1300	Unicorn-54930.exe	104
PID 2112 wrote to memory of 2988	2112	Unicorn-19553.exe	108
PID 2112 wrote to memory of 2988	2112	Unicorn-19553.exe	108
PID 2112 wrote to memory of 2988	2112	Unicorn-19553.exe	108
PID 376 wrote to memory of 2368	376	Unicorn-9818.exe	107
PID 376 wrote to memory of 2368	376	Unicorn-9818.exe	107
PID 376 wrote to memory of 2368	376	Unicorn-9818.exe	107
PID 1120 wrote to memory of 4956	1120	Unicorn-41947.exe	112
PID 1120 wrote to memory of 4956	1120	Unicorn-41947.exe	112
PID 1120 wrote to memory of 4956	1120	Unicorn-41947.exe	112
PID 1128 wrote to memory of 3128	1128	Unicorn-42123.exe	113
PID 1128 wrote to memory of 3128	1128	Unicorn-42123.exe	113
PID 1128 wrote to memory of 3128	1128	Unicorn-42123.exe	113
PID 3436 wrote to memory of 1448	3436	Unicorn-56015.exe	114
PID 3436 wrote to memory of 1448	3436	Unicorn-56015.exe	114
PID 3436 wrote to memory of 1448	3436	Unicorn-56015.exe	114
PID 1720 wrote to memory of 3124	1720	Unicorn-55755.exe	115
PID 1720 wrote to memory of 3124	1720	Unicorn-55755.exe	115
PID 1720 wrote to memory of 3124	1720	Unicorn-55755.exe	115
PID 1220 wrote to memory of 2580	1220	Unicorn-10343.exe	116
PID 1220 wrote to memory of 2580	1220	Unicorn-10343.exe	116
PID 1220 wrote to memory of 2580	1220	Unicorn-10343.exe	116
PID 3560 wrote to memory of 1172	3560	Unicorn-60971.exe	117
PID 3560 wrote to memory of 1172	3560	Unicorn-60971.exe	117
PID 3560 wrote to memory of 1172	3560	Unicorn-60971.exe	117
PID 3488 wrote to memory of 3112	3488	Unicorn-49833.exe	118

C:\Users\Admin\AppData\Local\Temp\00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe
"C:\Users\Admin\AppData\Local\Temp\00777c36712bb89e7ede0dd7ff7e33fe2b0dd1bb55d70eff87860a1301d4ef06N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9818.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9818.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42123.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41563.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exe
        9⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14810.exe
        10⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54326.exe
        11⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        11⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57308.exe
        11⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11980.exe
        10⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        10⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63261.exe
        9⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 632
        10⤵
        Program crash
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        9⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        8⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18934.exe
        9⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        10⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        9⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        9⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62980.exe
        8⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63814.exe
        9⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        8⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56994.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        9⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40182.exe
        10⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
        9⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        9⤵
        
        PID:15440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
        8⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55319.exe
        8⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58173.exe
        8⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32613.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        8⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        8⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2339.exe
        8⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
        8⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58830.exe
        7⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34203.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
        9⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53257.exe
        10⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        10⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57500.exe
        10⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        9⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
        9⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26556.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe
        9⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38572.exe
        9⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27939.exe
        8⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        8⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55286.exe
        8⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30813.exe
        7⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
        7⤵
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
        6⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        8⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        8⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14237.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42752.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12801.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9141.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
        8⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        8⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        7⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        7⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30880.exe
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50038.exe
        6⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34203.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        9⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27814.exe
        10⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        10⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        9⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        9⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe
        9⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        9⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24059.exe
        9⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        8⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        8⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        9⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26852.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        8⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
        7⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61885.exe
        7⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
        7⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe
        6⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe
        8⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20044.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        8⤵
        
        PID:15904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        7⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12804.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56137.exe
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43734.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        8⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
        8⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        7⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
        7⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
        7⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22717.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52519.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        6⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        6⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2488.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11322.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe
        8⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18444.exe
        8⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        8⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
        8⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
        7⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe
        7⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        7⤵
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        7⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42284.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
        7⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22051.exe
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe
        6⤵
        
        PID:12932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        6⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42006.exe
        7⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        7⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49924.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45056.exe
        6⤵
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe
        6⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44313.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        6⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28092.exe
        5⤵
        
        PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27046.exe
        5⤵
        
        PID:13380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        6⤵
        Executes dropped EXE
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3175.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54646.exe
        9⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        9⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
        8⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        8⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        8⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
        8⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40052.exe
        7⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25670.exe
        7⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        8⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        7⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        7⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        7⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22333.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59748.exe
        6⤵
        
        PID:10276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
        6⤵
        
        PID:15892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54654.exe
        6⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25649.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13050.exe
        6⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        8⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        8⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-688.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
        7⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61886.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        7⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
        7⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5596.exe
        6⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25752.exe
        5⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25670.exe
        7⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        8⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        7⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        7⤵
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2732.exe
        6⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        6⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        6⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        5⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19855.exe
        5⤵
        
        PID:12036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        5⤵
        
        PID:10152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58230.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2090.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
        6⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64104.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        8⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22795.exe
        8⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        7⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        7⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
        6⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe
        6⤵
        
        PID:14720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41516.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
        7⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-444.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10291.exe
        6⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44900.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60486.exe
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14118.exe
        5⤵
        
        PID:14808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        5⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56758.exe
        8⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exe
        8⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42284.exe
        7⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        7⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58580.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe
        6⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14179.exe
        5⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7035.exe
        5⤵
        
        PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
      4⤵
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25948.exe
        6⤵
        
        PID:12404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64725.exe
        6⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        5⤵
        
        PID:12756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
        5⤵
        
        PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25564.exe
      4⤵
      PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50557.exe
        5⤵
        
        PID:14296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44636.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63430.exe
      4⤵
      PID:9320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
      4⤵
      PID:15152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11962.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16011.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        8⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        9⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe
        10⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        9⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        8⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        8⤵
        
        PID:14088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14088 -s 464
        9⤵
        Program crash
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43101.exe
        7⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65358.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13341.exe
        7⤵
        
        PID:14868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
        6⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
        8⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        7⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        7⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        6⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55689.exe
        7⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exe
        7⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe
        6⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
        6⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        7⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        7⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
        6⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        7⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        6⤵
        
        PID:11032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        6⤵
        
        PID:15064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53257.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        7⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
        6⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35867.exe
        6⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61533.exe
        5⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        6⤵
        
        PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58004.exe
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33803.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        8⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        8⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2531.exe
        8⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60350.exe
        8⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19852.exe
        7⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4923.exe
        7⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        7⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28077.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        6⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        7⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe
        7⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19852.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        6⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        6⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32275.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56037.exe
        5⤵
        
        PID:528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44201.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32267.exe
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        6⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        7⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exe
        7⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64253.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        6⤵
        
        PID:13408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        6⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36924.exe
        6⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe
        5⤵
        
        PID:14920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37586.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        6⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        6⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17356.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
        5⤵
        
        PID:13464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
      4⤵
      PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        5⤵
        
        PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
      4⤵
      PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6779.exe
      4⤵
      PID:14532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16011.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-419.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58795.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        8⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36932.exe
        8⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        8⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        7⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
        7⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        6⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45046.exe
        7⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20155.exe
        7⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
        6⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19332.exe
        6⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48847.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        6⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
        7⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        7⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
        6⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56060.exe
        6⤵
        
        PID:10032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        5⤵
        
        PID:8672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        5⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4532.exe
        5⤵
        
        PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64674.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10746.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13466.exe
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        8⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34966.exe
        7⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        7⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1020.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34691.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        6⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
        6⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        5⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28077.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
        5⤵
        
        PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63625.exe
      4⤵
      PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51990.exe
        5⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        6⤵
        
        PID:13984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38668.exe
        6⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
        5⤵
        
        PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36365.exe
      4⤵
      PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        5⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42612.exe
        5⤵
        
        PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59748.exe
      4⤵
      PID:10756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        5⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        7⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55565.exe
        7⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        6⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
        5⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        5⤵
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23563.exe
        5⤵
        
        PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
      4⤵
      PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48534.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21270.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        6⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe
        5⤵
        
        PID:15236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55668.exe
      4⤵
      PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        5⤵
        
        PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1132.exe
      4⤵
      PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe
      4⤵
      PID:15048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8826.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        5⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15875.exe
        6⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5068.exe
        5⤵
        
        PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
        5⤵
        
        PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
      4⤵
      PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38572.exe
        5⤵
        
        PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62724.exe
      4⤵
      PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50093.exe
      4⤵
      PID:14792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50927.exe
    3⤵
    PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
      4⤵
      PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27622.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        5⤵
        
        PID:14568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53054.exe
        5⤵
        
        PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
      4⤵
      PID:14064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
      4⤵
      PID:2056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53398.exe
    3⤵
    PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
      4⤵
      PID:11204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
      4⤵
      PID:6512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
    3⤵
    PID:11100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
    3⤵
    PID:6700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19553.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19553.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60971.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20347.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63819.exe
        8⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        9⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        9⤵
        
        PID:11492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2339.exe
        9⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        8⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        8⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        7⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 632
        8⤵
        Program crash
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32835.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28077.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14325.exe
        7⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe
        8⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        8⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        8⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe
        7⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        6⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        7⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38572.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
        6⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56037.exe
        6⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39126.exe
        8⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        9⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        9⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42460.exe
        8⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19852.exe
        7⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39191.exe
        7⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        7⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44338.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        7⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        7⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe
        6⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13525.exe
        8⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        7⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe
        6⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12812 -s 464
        7⤵
        Program crash
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26010.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        6⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63120.exe
        5⤵
        
        PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        5⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20363.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25670.exe
        7⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        8⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        7⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2732.exe
        6⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
        6⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39334.exe
        6⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        6⤵
        
        PID:12940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
        5⤵
        
        PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe
        5⤵
        
        PID:12924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56428.exe
        5⤵
        
        PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28930.exe
      4⤵
      PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        6⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        7⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6459.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        5⤵
        
        PID:12600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
        5⤵
        
        PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37208.exe
      4⤵
      PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5068.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
        5⤵
        
        PID:14508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6380.exe
      4⤵
      PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14648.exe
      4⤵
      PID:14888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8625.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63592.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        6⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30662.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42889.exe
        8⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        8⤵
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        7⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27939.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        6⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56527.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50557.exe
        7⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42716.exe
        7⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        6⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        6⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
        5⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37251.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        5⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7565.exe
        5⤵
        
        PID:15228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18161.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26940.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44084.exe
        6⤵
        
        PID:11160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61184.exe
        5⤵
        
        PID:12212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47772.exe
        5⤵
        
        PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        5⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        5⤵
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        5⤵
        
        PID:14652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        5⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24635.exe
        5⤵
        
        PID:14396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
      4⤵
      PID:12736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30092.exe
      4⤵
      PID:8252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59273.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        7⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51325.exe
        7⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        7⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        6⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        6⤵
        
        PID:14844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        5⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        5⤵
        
        PID:14740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47970.exe
      4⤵
      PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        5⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe
        6⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
      4⤵
      PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
      4⤵
      PID:11420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
      4⤵
      PID:9432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        6⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        6⤵
        
        PID:13652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
        5⤵
        
        PID:14120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26765.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38311.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe
      4⤵
      PID:15960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56985.exe
    3⤵
    PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
      4⤵
      PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        5⤵
        
        PID:13968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        5⤵
        
        PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
      4⤵
      PID:9356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
      4⤵
      PID:14440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36332.exe
    3⤵
    PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
      4⤵
      PID:5780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
    3⤵
    PID:10460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6779.exe
    3⤵
    PID:15012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10343.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47448.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
        6⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        8⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15580.exe
        9⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        8⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        8⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        7⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34765.exe
        7⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29998.exe
        8⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39004.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35972.exe
        7⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30501.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        6⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        5⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38443.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
        7⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        6⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        7⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45001.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        6⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        5⤵
        
        PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47762.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37275.exe
        6⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        8⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        8⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        8⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49664.exe
        7⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
        7⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        6⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        7⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46317.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        6⤵
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        6⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
        5⤵
        
        PID:14612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43241.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe
        6⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25019.exe
        7⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        6⤵
        
        PID:12672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47917.exe
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2403.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        5⤵
        
        PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
      4⤵
      PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        5⤵
        
        PID:13836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22915.exe
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
      4⤵
      PID:14384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43726.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52443.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe
        6⤵
        
        PID:11192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        6⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe
        5⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        6⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        5⤵
        
        PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
        5⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25670.exe
        6⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43484.exe
        7⤵
        
        PID:9940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        6⤵
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        5⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
        6⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
      4⤵
      PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6639.exe
        5⤵
        
        PID:13888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        5⤵
        
        PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31581.exe
      4⤵
      PID:8560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
      4⤵
      PID:14492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27083.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58285.exe
        5⤵
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        5⤵
        
        PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
      4⤵
      PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63822.exe
        5⤵
        
        PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe
      4⤵
      PID:9612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-113.exe
    3⤵
    PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20956.exe
        5⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54101.exe
        5⤵
        
        PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44077.exe
      4⤵
      PID:516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15875.exe
      4⤵
      PID:14356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
    3⤵
    PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
      4⤵
      PID:11236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
      4⤵
      PID:13116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41468.exe
    3⤵
    PID:11092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
    3⤵
    PID:14340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11697.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11697.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 464
    3⤵
    - Program crash
    PID:876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
      4⤵
      PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42390.exe
        5⤵
        
        PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29388.exe
        5⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        5⤵
        
        PID:14472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        5⤵
        
        PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2732.exe
      4⤵
      PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46317.exe
      4⤵
      PID:12680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57781.exe
      4⤵
      PID:10164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
    3⤵
    PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14709.exe
      4⤵
      PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37990.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40365.exe
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        5⤵
        
        PID:13640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
      4⤵
      PID:9352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16451.exe
      4⤵
      PID:14352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39332.exe
    3⤵
    PID:7808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
    3⤵
    PID:10288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe
    3⤵
    PID:15044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12753.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12753.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
    3⤵
    PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63718.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        5⤵
        
        PID:9660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        5⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        5⤵
        
        PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65268.exe
      4⤵
      PID:14620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
    3⤵
    PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54646.exe
      4⤵
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
      4⤵
      PID:2068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29859.exe
    3⤵
    PID:10664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
    3⤵
    PID:15184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
  2⤵
  PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43734.exe
    3⤵
    PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
      4⤵
      PID:11544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38572.exe
      4⤵
      PID:15404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
    3⤵
    PID:11128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
    3⤵
    PID:14856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42526.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42526.exe
  2⤵
  PID:7600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
  2⤵
  PID:12100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
  2⤵
  PID:15620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3992 -ip 3992
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6424 -ip 6424
1⤵
PID:10064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 6844 -ip 6844
1⤵
PID:11604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 14088 -ip 14088
1⤵
PID:15952

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10343.exe

Filesize
468KB

MD5
7589d71052e68e99bf65aa76e8b6c50c

SHA1
1b97bdecd6f4c492b2c7ee86218cfe4fe028d648

SHA256
d4b002f689c5835f70fc3dd2bc6e32cdc442a61969239f359b233ce33e8cc260

SHA512
d6af25d1e003032ac629e8625cfb88c43054d9b30f664a996be984824d6960f4ad43ee715877048a3309ee7e146456628a258f34bbbfb4778c2d2e8ad17b778d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11697.exe

Filesize
468KB

MD5
47d793725f7981a45722efeaec768308

SHA1
c6c45eefde166cbf1548f24ff52db090a02a082a

SHA256
199d3b0c0e578504a61d77002bdb12ae4f19f99beacc89bbdb80cc564b370d4f

SHA512
d3dc1ca69d7aa1a50538c8199c3af50f82d0f9e6c3620e38fec186436192f93607a6ba750438a1086d4b95967e8525a9e576d404bfaba3768ce4ad93153e00d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11962.exe

Filesize
468KB

MD5
a371cf7229c6d3392f4cd3910218a370

SHA1
80d76e7b0950ebaf6fc9d565e0e95778a32b5059

SHA256
fec8668839e14720f227ef819ce708c0ab023a1854547cf8306b803877234929

SHA512
127f1e50aaf449a52443b000b759c001ea2f14a7a823fdaf6b8424d934392222b5344e7b40571e235535e3707b0521bd0cd288d439e2ff8efa8d5be2d85a916d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe

Filesize
468KB

MD5
5590a232af48745f72c488a34fed9255

SHA1
46fabff523b80824f3ad841fb7e40b767ef9f1f0

SHA256
b41637ce89ad70a53b290c9cc71f86e10dd1af627bae30bdac1158fa00c15852

SHA512
83958d71a072b634e9f55eadbacde551ae728a637d1afb8880c74315c72e4c721aa25d7c639935d29c9e010f8b6f8cf98af924605526bd89d846cb45024c790a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16011.exe

Filesize
468KB

MD5
936f92bd9952f17dd0aaedcf54c47dc5

SHA1
0384645ad268f4023a7e8badf3ce00e0c4cec91b

SHA256
ff04c1246e1b98318b482bfe1db7a5beb53f759ac63305cbc0bed7184bee01b2

SHA512
18218e035f5a298157301c72937cd678d9eafbad60f4e98b958a58ba291f8834b1fec137cf8b4a785667c17ab4f1a14d68127074e66c89dcbc5c68bdfa0b47c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19553.exe

Filesize
468KB

MD5
a6291dbddc59432a60146aef572db56f

SHA1
9b0ab262ea7d9cafc72cbdfad99900afb1f734dd

SHA256
fce1c3a73a036da765b27867087b9c70d1d6be0003aeacf7e81795aea3afb859

SHA512
6a45400fee90ac91be82f99dfc7955a08ed0a85b516355a1d979f4c842e392aa8f0828641023b99b001baa24fe4d1c9a1f6d8b4d2cc7ffb14a0dad9d56a7c79b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21889.exe

Filesize
468KB

MD5
20387c74d7d2fe0225c87cffd74f37ff

SHA1
81b18a38d8c758517bffbc485e4113848b225ab3

SHA256
ee9a672b2f2941b9d6ba09926531cf26658a66ad73dc3a4aa334cfd34071a6e6

SHA512
a7b88a5f5b9a1d87310bedd25e0ec2929a1b871d2087d317b04334815a3728bd1ec7a4b73632581fe3188c27ae39257f057e2707c30d9496bbcea5ae9a826ef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22360.exe

Filesize
468KB

MD5
c00932d02d35b1c8302214da412d7c0f

SHA1
b4005804975f5a00d48cc783c245f470fe523575

SHA256
fb545b4366e36b5bb8f29450e53f91576c6d2af6955025d91f9907a71d90dc5d

SHA512
dbdd6ec11f96ce460e2dabbced5caf0911b3545a4b001812c00b359c832e3b406da9ac1032a8ed26f4cde55c372c920b7bbaa3497481cf1945acaaaaf05dd232

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe

Filesize
468KB

MD5
e029a5f2ac8c7bd3355f4a0426080fee

SHA1
4b9190b98becc87a8fbbb77981a5034f27d9b8aa

SHA256
f6f8133c9be03c506df2d81cfcd665a1e3657cb0ecdc9845a3d4ddb278997022

SHA512
98a5cb1b2d86b9acc0597b71fc48d615f2445712e2733559eda2e508a9a7c0c9acd5af254fdec6be9da52b6d16af453e66af7ef6786d22446b81ccf0b427e68d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe

Filesize
468KB

MD5
3cf3e03ed1d24590082e14e81bedee6b

SHA1
e5c278e0b14b654bd8d3911b3b63e6ae93335b60

SHA256
344155e8f22cabbf9f733a14c7fbbe8bdb1daaa0b4ea4fdb3080c31235f3e80d

SHA512
8dc25fcc42a08d07242f99feae909fbebb90a91face22d5f679cf39f1657ad5c674015fa4029de7c248caf02522f86bbeca9d6b87ef63108a0c3b1b9145d194b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exe

Filesize
468KB

MD5
3f4e9c26128f61e839467fd7497aaf09

SHA1
222a83b019c1f0e5596527c9979230e0c64c3985

SHA256
1faa2ef79398f2a7e0d05480ec1027ffee2a41334b13ba83ded3f619d8e4e978

SHA512
e67fa7c2e9e317a61b960a7de71da101378d3d40b263307b448c952579fa33ad7258adc0fe7d0774b34200766b58c3f2bb5f51b616b6c8c7f40867572d939394

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41563.exe

Filesize
468KB

MD5
9c6db9ccec5c046f38d02514a496fac3

SHA1
21602d4b8f33a498284463316773408f356b00ba

SHA256
a99cf9d9bd0484fb42f54471e45e5d6309171db057d6a209b1c22ea234185eac

SHA512
1609c06d8d4d4618eb5ecfd165b326dda6fc540b7d53c28cb7b4410b7c71a3061d757238936f892ea0406c51f5dc56d93109574230f9c025ecc49ebf37a1fcf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe

Filesize
468KB

MD5
7138ee38807f9fbea3954b6c0d487c1d

SHA1
49e7c4ed1484942896f9f7b8802d37e4eda3ab8c

SHA256
7fee5107580edd676c2ee28abb8c35c61986a6fd94e583d960d1d348b9834846

SHA512
cd83925730cdaf55f11ef278aedabd16021d62cf3a6cf334e214c7effa79c05b51b6a9b41ea61e05569d5604a419a7ff36e8b94aab5a3425601a4e66e8550505

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42123.exe

Filesize
468KB

MD5
fe9a272779248990c74c38c376b07984

SHA1
191154ecccb00efe811ae30c1584f708379c8147

SHA256
62816208718cafaf915b6470a17781676e730671bc7b9fa932ad6658325591cb

SHA512
f14f9746b3e018f0a282e6a4dc5e315362a11ad525b51656a37132500c186554dbf68f56ae8ce243ef6e5b7332074a2f4316ee258866335afda096ce958d4b71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43726.exe

Filesize
468KB

MD5
c3c4fdde0509b8f9027ce92b83063634

SHA1
1306bc1c79c2cce910a17ca1284a755f15fa3697

SHA256
b51cbe771fdf6fea2a780805daf4669a446abc1191b49f785015f292b5967394

SHA512
d0f2f9b39f0a88287d8f33fa4b319ffdee21afba90442353cef0a60a2002e078b8d3ad284a6fc942c3fe296649c40544ea2960d06cc57ac93a4ba45cb5e5d871

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47448.exe

Filesize
468KB

MD5
c4af2907413152d5d53fc2dfc9b428bb

SHA1
2941a1cae623418fc33742fd46f677d3db55b6d7

SHA256
be460c1c4b938e5e0f25c52309679e4af1558faf60ac0962b36db97702abcce3

SHA512
6f47fd7d275d45521eedaded68be1f3fb3965ff57cb412bba1f75a69c838de06b2c3f3859413b43c8e8413519be80e10210faa7a897270607fc19d06f527eb73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe

Filesize
468KB

MD5
339d3b11714e9139a767e518099e7421

SHA1
a3ea93aa34a6166d008378b12461c5d391c11c93

SHA256
7c7e8f97ea7ba4895af5105f1265b8741b093fcb67ad379d448bb0905eca2f96

SHA512
ae5b818dfb2656b2024c09de07346d12ed70bc198d48d0b4abe1bc853b5a891046be40c5dede7ab73d86122578838abc9897185738a5566bf7c9d808bd08b785

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe

Filesize
468KB

MD5
ee7b186897f4ec00b31f4b2e95d0bcbd

SHA1
9fae56c7400d4944f092ec868603215d34b9b5c4

SHA256
235edade721243639cfbdb583e51560bf29ff9eb051c523dc03d0aaf09503959

SHA512
a811847c0cb6134fc24a018f078d11e8e74f6243230543a426c57bf47c7fb82423d1d7dd8375450eaf29d879727e1efb6b372b3b8c3987aeabeb5179f4bd7801

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe

Filesize
468KB

MD5
0d397e01ae43aca04e19dfcd8054a2ec

SHA1
0277192cf5249c42574c4c333dae1c26cf56db38

SHA256
efb770952120542698c4e9ebf72ba28387bd2b4909999a901714d1a1e2801651

SHA512
e4527091bfe12f1756db740ac6d8676401b90cf63762ec39614a09966f22ab4ade73007ac512160bf70d686403a783f73e3790bbd6a6dce715ac1474fb7395aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe

Filesize
468KB

MD5
96520925dd75f4b5f6d12fd7e68dc263

SHA1
281cd4129a48db40ac1eccd360a12c5f5ad51a18

SHA256
e3fb454b59e7c5c0c96bd2dc2941c60ead367edaf82f4d84c0e7074dc30dd7cd

SHA512
b44742fd3bcc9a99688cb6be6c4ea72cbe9542bf7160a4878f353db5843d7039507c2d3767679b06f5f2cfcdfcdfd93e0fd8c6e66c3fd1783cfcde41c83c6e9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe

Filesize
468KB

MD5
c936763c5737a8428a74cfba0c86ab3a

SHA1
b6c2a5d3c60415e7ee89fd0f0481092207637626

SHA256
66c93e473e8fb70718b53191dabbd6ab177ebb26c6823f3bc450c54f9151b2bb

SHA512
5032787e3fb2f7f3fb66407a48edc52ce3bba18a2eac9ceafa856b3215ddfe4ecd534db3f675b9ed4965ec547fc84848e3f183541cb421069eb9f15c0d8691aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe

Filesize
468KB

MD5
536f4b97d4c62319e46da1666e9bcc60

SHA1
f571383e268d5a698183da9eadb2ed0ca1fcdac3

SHA256
2867e05e988d66a37ecb53017fe90141feaf5bc05bf91024bbd4f0bb1f7bca67

SHA512
8077bf3d8b4cd69d0ce3b1e9d0a0c1d02d423ea4fec37c5931e58352e824784a076a8399af59c0cd97263b362e6c5530ab90b430cbfe7050ec24374a791ab12b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58230.exe

Filesize
468KB

MD5
366bae8a93a5bd2f87c8a935731818ce

SHA1
58362c2fc4c3ea19f402f5adbbc3d3ff119b6b78

SHA256
000bddbb3c358d4cfd6ad0d20521c1e418ee573710f3396a26fb732cc4f7bac3

SHA512
3a91f409ae61d85a611063e67da0d2fe2b78b784c082724f756de75a821aad25a830f591780985ef5b8a31d3f472d4519af22d13d6774b8e34692e3a08759629

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58395.exe

Filesize
468KB

MD5
0192f467742ee05f085ac16e2bd333d0

SHA1
08a3f147a78a6d9a7ba8ead256d7ecf1c8120650

SHA256
1abbfc711b1cbdc6cb90a3d5d7358532f38415d490375536574ba760eabf962e

SHA512
729309904b32d3d249d295f6fa0ff45e83ca77345c8646c1ad9d68de0201149247bc58698d2ef60d2c4208275f41c2e1accb3ba9ed9db3aee86bdaea035e2676

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59273.exe

Filesize
468KB

MD5
44a777c74dbf579ed779890ca86a6c5e

SHA1
f034dc8131a9c8427cb666e2346bf6150e70f0f4

SHA256
effe99e9d66d59db11ec676628e26998eaa10d38051043374d1b12e9028bcab1

SHA512
8679cf0cc0df20931174d635c8a7985b786481b55c49d1067e8156ff38226d0c1ab250c8164f800332678b681bd08ad873893cc5fcb75dbb9174860b1fdde7f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60971.exe

Filesize
468KB

MD5
6e01f151e87e82484cc3748ef63d1367

SHA1
2f00078ba719d9a0c9e951b82798a031af804b56

SHA256
b341160f0b8ea50490a5a364f9f6330235cc1748231f8308f4e9bd4e15e0a396

SHA512
da2a2e51e14aadd63edf7d7a15ea2df4d4d7b6ef343f1bc696bab8631a81e799819672197c90a1a139dc09711d21ba321c4ae757df7555ef88bff9bbb1518ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exe

Filesize
468KB

MD5
43a6215023ca184202a5fb95c5a49b2d

SHA1
af227664f2fcfc8d7f6f41c6ae1a75702d605cd0

SHA256
bf52201e52a0adadcf1d216425279cccf211eca0803b7a4d20f9d4c907b00d47

SHA512
940fbc628f8cc294c3b286040967e624e2ece66479c44b6e2e8a17266e599ee2a8ae395f0d5a40a3a509280ae7a447f3ea54d9289a0ca74d4ca0cd5d214f5ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63592.exe

Filesize
468KB

MD5
de2d0b4607164499c5748eecb38aba7b

SHA1
22c5e943d6eb1fd2a2a2c51746d05c65ab71bad9

SHA256
3f14fa5b3f1ad4f86579ea803b9d8072a0307cc580ea2131cec54c6ab3bd8dd8

SHA512
080fca091aa577f0f9e6d936f0f633dd28df08337b97c4fef0bb087faa84c97b3f0b6c6d5ef5fbff7e4fb7167897acaedc600a7dfb7929cb2df0883a261154a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe

Filesize
468KB

MD5
174855de96d91560d5ea17ad7cd24aa0

SHA1
a15a2978c6d6a644bdb0b7180c8cdfc3d3f8bb90

SHA256
dca542ea9bdc6e9d6a03704759ad884a03c9f3b5c8fa1db026e63ee67372990c

SHA512
d65421b6e6b9005030c7cbfbbeddc7165edcd275aa637e4697853dfd264da31e0703497db93eaa448dabd058baadbeae6ec72ab516a82b42cc2df572bf65f5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8625.exe

Filesize
468KB

MD5
b056286f8ebc7758501315cf12b679cd

SHA1
cc1e9428a4ae964bef4f0bc06c84163f9b7318ae

SHA256
5712136ad4384105efb517548083e9afd845fc962e612b351495d0c4808b2dd4

SHA512
cb2a295436f8b9c49cd6e66581da2254d136dddd97f4ff5d3c4d72a17bc989f8b44d2a214df228f766c9526d522f8711f4f459d4e125afb5e6a79d25fa6ed33d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9818.exe

Filesize
468KB

MD5
23fbf8178922cb1fa06b8d336b4538d7

SHA1
9240d4e7a55002cb9cd86a5d9a8cc38150e83b88

SHA256
7ab13042bd971da9f4bc362e28c60f5946b4f4522596e5ff5d610cbe0ab5e25b

SHA512
13674945ae6dd44653898cffaf251851e40746611128d2332843c0a0daff2fd580dfb8bb7235c0564f3cdab8cdcea7d8f6a9676f87dd6ec7b72c3085d99acfcb

Download Submit
memory/376-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/380-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/684-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/876-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1172-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1220-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1300-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1360-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1408-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1448-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1720-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1776-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2204-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2368-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2496-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3060-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3128-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3240-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3260-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3436-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3532-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3772-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3788-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3852-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3884-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3984-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3992-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3992-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4104-2432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4108-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4212-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4232-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4268-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4272-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4464-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4848-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4868-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4956-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5240-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5304-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5312-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5368-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5400-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5592-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5636-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5652-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5668-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5680-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5700-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5728-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5828-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5880-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5916-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5928-573-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5952-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11996-2416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11996-2417-0x0000000077B80000-0x0000000077B8A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads