7294bd8fae7ebca3bf3a3aa762d401a41d6810bc44eae1add8b691257744a911

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7294bd8fae7ebca3bf3a3aa762d401a41d6810bc44eae1add8b691257744a911.exe
Size 184KB
Sample260916-m117xaaf42
SHA256 7294bd8fae7ebca3bf3a3aa762d401a41d6810bc44eae1add8b691257744a911
MD5 a6a78e3247eb0e073adbfbcf62c2eaad
SHA1 d87d51034c4dd4f98edb83cb2e7aa35da21b79c6
SHA512 7263d31edbabeeeef47fcd536c49265685f8067a7afa744c0a89c1150d4c5a0fb2ac9078dc2241579a0342dcbe5976b33472495ff3948377f13cd4f4ccf0b2b8
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8L53vvqgviuQ:tmeoZ0975haL53Xqgviu
TLSH
T157048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3644	Unicorn-42003.exe
4132	Unicorn-62457.exe
2432	Unicorn-5643.exe
4588	Unicorn-24881.exe
3816	Unicorn-35279.exe
4444	Unicorn-25627.exe
2112	Unicorn-48352.exe
2932	Unicorn-18633.exe
4284	Unicorn-15295.exe
2324	Unicorn-39245.exe
2428	Unicorn-7688.exe
1036	Unicorn-1558.exe
3448	Unicorn-7423.exe
3348	Unicorn-41897.exe
3828	Unicorn-64163.exe
1216	Unicorn-13500.exe
4324	Unicorn-10163.exe
1404	Unicorn-2592.exe
2988	Unicorn-57915.exe
4368	Unicorn-39541.exe
2236	Unicorn-39541.exe
3840	Unicorn-38779.exe
896	Unicorn-27843.exe
1476	Unicorn-47709.exe
1220	Unicorn-59504.exe
3796	Unicorn-64408.exe
4780	Unicorn-10952.exe
1604	Unicorn-35649.exe
1648	Unicorn-31300.exe
3380	Unicorn-11699.exe
4384	Unicorn-38315.exe
4960	Unicorn-43345.exe
3388	Unicorn-55405.exe
4752	Unicorn-2120.exe
1652	Unicorn-37023.exe
4000	Unicorn-27371.exe
4332	Unicorn-35347.exe
928	Unicorn-63189.exe
3688	Unicorn-2483.exe
1816	Unicorn-34601.exe
1544	Unicorn-60449.exe
2972	Unicorn-52836.exe
2348	Unicorn-52836.exe
2564	Unicorn-11056.exe
4204	Unicorn-11056.exe
3108	Unicorn-6972.exe
5100	Unicorn-23501.exe
1596	Unicorn-1934.exe
732	Unicorn-10599.exe
4464	Unicorn-4734.exe
4156	Unicorn-55020.exe
4952	Unicorn-19033.exe
2064	Unicorn-39453.exe
4376	Unicorn-19587.exe
3832	Unicorn-39453.exe
5004	Unicorn-57133.exe
776	Unicorn-49520.exe
364	Unicorn-64539.exe
2080	Unicorn-1802.exe
2412	Unicorn-40797.exe
4804	Unicorn-46727.exe
116	Unicorn-47303.exe
4744	Unicorn-49157.exe
3352	Unicorn-38803.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
12048	11832	WerFault.exe	552
12128	11752	WerFault.exe	551
1748	11880	WerFault.exe	554
18336	716	WerFault.exe	762
18344	5828	WerFault.exe	781
18352	5096	WerFault.exe	761
18408	6052	WerFault.exe	788

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33262.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	9984	dwm.exe
Token: SeChangeNotifyPrivilege	9984	dwm.exe
Token: 33	9984	dwm.exe
Token: SeIncBasePriorityPrivilege	9984	dwm.exe
Token: SeCreateGlobalPrivilege	10556	dwm.exe
Token: SeChangeNotifyPrivilege	10556	dwm.exe
Token: 33	10556	dwm.exe
Token: SeIncBasePriorityPrivilege	10556	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1560	7294bd8fae7ebca3bf3a3aa762d401a41d6810bc44eae1add8b691257744a911.exe
3644	Unicorn-42003.exe
4132	Unicorn-62457.exe
2432	Unicorn-5643.exe
4588	Unicorn-24881.exe
3816	Unicorn-35279.exe
4444	Unicorn-25627.exe
2112	Unicorn-48352.exe
2932	Unicorn-18633.exe
4284	Unicorn-15295.exe
2324	Unicorn-39245.exe
3448	Unicorn-7423.exe
1036	Unicorn-1558.exe
2428	Unicorn-7688.exe
3348	Unicorn-41897.exe
3828	Unicorn-64163.exe
1216	Unicorn-13500.exe
4324	Unicorn-10163.exe
1404	Unicorn-2592.exe
4368	Unicorn-39541.exe
2236	Unicorn-39541.exe
2988	Unicorn-57915.exe
1476	Unicorn-47709.exe
896	Unicorn-27843.exe
3840	Unicorn-38779.exe
1220	Unicorn-59504.exe
3796	Unicorn-64408.exe
1604	Unicorn-35649.exe
1648	Unicorn-31300.exe
3380	Unicorn-11699.exe
4780	Unicorn-10952.exe
4384	Unicorn-38315.exe
4960	Unicorn-43345.exe
3388	Unicorn-55405.exe
4752	Unicorn-2120.exe
1652	Unicorn-37023.exe
4000	Unicorn-27371.exe
928	Unicorn-63189.exe
3688	Unicorn-2483.exe
1816	Unicorn-34601.exe
1544	Unicorn-60449.exe
2348	Unicorn-52836.exe
2972	Unicorn-52836.exe
4204	Unicorn-11056.exe
2564	Unicorn-11056.exe
3108	Unicorn-6972.exe
5100	Unicorn-23501.exe
1596	Unicorn-1934.exe
4464	Unicorn-4734.exe
732	Unicorn-10599.exe
4156	Unicorn-55020.exe
4952	Unicorn-19033.exe
2064	Unicorn-39453.exe
3832	Unicorn-39453.exe
5004	Unicorn-57133.exe
4376	Unicorn-19587.exe
776	Unicorn-49520.exe
2080	Unicorn-1802.exe
2412	Unicorn-40797.exe
4804	Unicorn-46727.exe
364	Unicorn-64539.exe
116	Unicorn-47303.exe
4744	Unicorn-49157.exe
3352	Unicorn-38803.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 3644	1560	7294bd8fae7ebca3bf3a3aa762d401a41d6810bc44eae1add8b691257744a911.exe	88
PID 3644 wrote to memory of 4132	3644	Unicorn-42003.exe	89
PID 1560 wrote to memory of 2432	1560	7294bd8fae7ebca3bf3a3aa762d401a41d6810bc44eae1add8b691257744a911.exe	90
PID 4132 wrote to memory of 4588	4132	Unicorn-62457.exe	91
PID 1560 wrote to memory of 3816	1560	7294bd8fae7ebca3bf3a3aa762d401a41d6810bc44eae1add8b691257744a911.exe	92
PID 3644 wrote to memory of 4444	3644	Unicorn-42003.exe	93
PID 2432 wrote to memory of 2112	2432	Unicorn-5643.exe	94
PID 4588 wrote to memory of 2932	4588	Unicorn-24881.exe	95
PID 4132 wrote to memory of 4284	4132	Unicorn-62457.exe	96
PID 3816 wrote to memory of 2324	3816	Unicorn-35279.exe	97
PID 4444 wrote to memory of 2428	4444	Unicorn-25627.exe	98
PID 1560 wrote to memory of 3448	1560	7294bd8fae7ebca3bf3a3aa762d401a41d6810bc44eae1add8b691257744a911.exe	100
PID 3644 wrote to memory of 1036	3644	Unicorn-42003.exe	99
PID 2112 wrote to memory of 3348	2112	Unicorn-48352.exe	101
PID 2432 wrote to memory of 3828	2432	Unicorn-5643.exe	102
PID 2932 wrote to memory of 1216	2932	Unicorn-18633.exe	103
PID 4588 wrote to memory of 4324	4588	Unicorn-24881.exe	104
PID 4284 wrote to memory of 1404	4284	Unicorn-15295.exe	105
PID 4132 wrote to memory of 2988	4132	Unicorn-62457.exe	106
PID 3448 wrote to memory of 4368	3448	Unicorn-7423.exe	107
PID 2324 wrote to memory of 2236	2324	Unicorn-39245.exe	108
PID 1560 wrote to memory of 3840	1560	7294bd8fae7ebca3bf3a3aa762d401a41d6810bc44eae1add8b691257744a911.exe	109
PID 3816 wrote to memory of 896	3816	Unicorn-35279.exe	110
PID 1036 wrote to memory of 1476	1036	Unicorn-1558.exe	111
PID 3644 wrote to memory of 1220	3644	Unicorn-42003.exe	112
PID 4444 wrote to memory of 3796	4444	Unicorn-25627.exe	113
PID 3348 wrote to memory of 4780	3348	Unicorn-41897.exe	114
PID 3828 wrote to memory of 1604	3828	Unicorn-64163.exe	115
PID 2432 wrote to memory of 1648	2432	Unicorn-5643.exe	116
PID 2112 wrote to memory of 3380	2112	Unicorn-48352.exe	117
PID 2428 wrote to memory of 4384	2428	Unicorn-7688.exe	118
PID 4324 wrote to memory of 4960	4324	Unicorn-10163.exe	119
PID 1476 wrote to memory of 3388	1476	Unicorn-47709.exe	120
PID 1216 wrote to memory of 4752	1216	Unicorn-13500.exe	121
PID 4588 wrote to memory of 1652	4588	Unicorn-24881.exe	122
PID 2932 wrote to memory of 4000	2932	Unicorn-18633.exe	123
PID 1036 wrote to memory of 4332	1036	Unicorn-1558.exe	124
PID 1404 wrote to memory of 928	1404	Unicorn-2592.exe	125
PID 4284 wrote to memory of 3688	4284	Unicorn-15295.exe	126
PID 2236 wrote to memory of 1816	2236	Unicorn-39541.exe	127
PID 4368 wrote to memory of 1544	4368	Unicorn-39541.exe	128
PID 3448 wrote to memory of 2348	3448	Unicorn-7423.exe	130
PID 2324 wrote to memory of 2972	2324	Unicorn-39245.exe	129
PID 3840 wrote to memory of 2564	3840	Unicorn-38779.exe	132
PID 3796 wrote to memory of 4204	3796	Unicorn-64408.exe	131
PID 2988 wrote to memory of 3108	2988	Unicorn-57915.exe	133
PID 896 wrote to memory of 5100	896	Unicorn-27843.exe	134
PID 3644 wrote to memory of 1596	3644	Unicorn-42003.exe	135
PID 4132 wrote to memory of 732	4132	Unicorn-62457.exe	136
PID 3816 wrote to memory of 4464	3816	Unicorn-35279.exe	137
PID 1560 wrote to memory of 4156	1560	7294bd8fae7ebca3bf3a3aa762d401a41d6810bc44eae1add8b691257744a911.exe	138
PID 1604 wrote to memory of 4952	1604	Unicorn-35649.exe	139
PID 4780 wrote to memory of 2064	4780	Unicorn-10952.exe	140
PID 3828 wrote to memory of 4376	3828	Unicorn-64163.exe	141
PID 1648 wrote to memory of 3832	1648	Unicorn-31300.exe	142
PID 3380 wrote to memory of 5004	3380	Unicorn-11699.exe	143
PID 3348 wrote to memory of 776	3348	Unicorn-41897.exe	144
PID 2112 wrote to memory of 2080	2112	Unicorn-48352.exe	146
PID 2432 wrote to memory of 364	2432	Unicorn-5643.exe	145
PID 4384 wrote to memory of 2412	4384	Unicorn-38315.exe	147
PID 2428 wrote to memory of 4804	2428	Unicorn-7688.exe	148
PID 1036 wrote to memory of 116	1036	Unicorn-1558.exe	149
PID 4960 wrote to memory of 4744	4960	Unicorn-43345.exe	150
PID 4324 wrote to memory of 3352	4324	Unicorn-10163.exe	151

C:\Users\Admin\AppData\Local\Temp\7294bd8fae7ebca3bf3a3aa762d401a41d6810bc44eae1add8b691257744a911.exe
"C:\Users\Admin\AppData\Local\Temp\7294bd8fae7ebca3bf3a3aa762d401a41d6810bc44eae1add8b691257744a911.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42003.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42003.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62457.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18633.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2120.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        8⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-776.exe
        9⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24751.exe
        10⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12698.exe
        10⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        10⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        10⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        9⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44927.exe
        9⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        9⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        9⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        9⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        8⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9500.exe
        9⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
        9⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47167.exe
        9⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        9⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        8⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        8⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        8⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        8⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        8⤵
        
        PID:18128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51824.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34373.exe
        8⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37409.exe
        9⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6747.exe
        9⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-218.exe
        9⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        9⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        9⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49536.exe
        8⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        8⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8527.exe
        8⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        8⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        8⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12098.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
        8⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
        8⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exe
        8⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        8⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33465.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14227.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
        7⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26611.exe
        7⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        7⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60860.exe
        7⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18213.exe
        7⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-932.exe
        8⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
        9⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
        9⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4930.exe
        9⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        9⤵
        
        PID:17996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65465.exe
        9⤵
        
        PID:17932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44735.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4523.exe
        8⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        8⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        8⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26657.exe
        8⤵
        
        PID:17476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        7⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        8⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        8⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        8⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48512.exe
        8⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        8⤵
        
        PID:17696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        8⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        7⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        7⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        7⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        7⤵
        
        PID:17812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33364.exe
        7⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28418.exe
        6⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58493.exe
        7⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
        8⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        8⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
        8⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40895.exe
        7⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        7⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62239.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6671.exe
        6⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2816.exe
        7⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38459.exe
        7⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        7⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        7⤵
        
        PID:16176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58991.exe
        7⤵
        
        PID:18092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21706.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17060.exe
        6⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27206.exe
        6⤵
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        6⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49157.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51633.exe
        9⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
        9⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        9⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        9⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36433.exe
        9⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37387.exe
        8⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        8⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15778.exe
        8⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51864.exe
        8⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45488.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
        8⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33355.exe
        8⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
        8⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        8⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        8⤵
        
        PID:17712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        8⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exe
        7⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        7⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 464
        8⤵
        Program crash
        
        PID:18344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        7⤵
        
        PID:17972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        8⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        8⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        8⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        8⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        8⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        8⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        7⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        7⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58148.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        7⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16068.exe
        7⤵
        
        PID:18252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46779.exe
        6⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        7⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        7⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        7⤵
        
        PID:17492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26226.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32719.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        6⤵
        
        PID:8672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37023.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        6⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58493.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
        8⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        8⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        8⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44735.exe
        7⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24752.exe
        7⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        7⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        7⤵
        
        PID:18136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
        7⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        7⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe
        7⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        7⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51132.exe
        6⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        6⤵
        
        PID:18120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        5⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        6⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41493.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        7⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        7⤵
        
        PID:17236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58607.exe
        7⤵
        
        PID:17452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40895.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        6⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        6⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        6⤵
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62253.exe
        6⤵
        
        PID:14580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9255.exe
        5⤵
        
        PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61066.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29079.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
        5⤵
        
        PID:17888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23954.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63189.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54549.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        9⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        9⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        9⤵
        
        PID:17848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        9⤵
        
        PID:16984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4523.exe
        8⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
        8⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        8⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        8⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        8⤵
        
        PID:17960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10755.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29981.exe
        8⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        8⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65107.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4509.exe
        8⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe
        7⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        7⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
        7⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14287.exe
        7⤵
        
        PID:17312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        7⤵
        
        PID:17800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        6⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
        7⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        7⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5911.exe
        7⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
        7⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48803.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57256.exe
        7⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19014.exe
        7⤵
        
        PID:17300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        6⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        6⤵
        
        PID:11992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
        6⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52157.exe
        6⤵
        
        PID:17112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36197.exe
        6⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2483.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27689.exe
        6⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47149.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        8⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16132.exe
        8⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20482.exe
        7⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43608.exe
        7⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35098.exe
        7⤵
        
        PID:17012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe
        7⤵
        
        PID:18024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22249.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        7⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        6⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
        6⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47151.exe
        6⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35155.exe
        5⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60993.exe
        7⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5911.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        6⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9551.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        6⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46244.exe
        6⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
        6⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        6⤵
        
        PID:17928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58169.exe
        6⤵
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
        5⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34395.exe
        5⤵
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15820.exe
        5⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42686.exe
        5⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60860.exe
        5⤵
        
        PID:17552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6972.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62857.exe
        6⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        7⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        7⤵
        
        PID:17640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27771.exe
        6⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26530.exe
        6⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        6⤵
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        6⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        6⤵
        
        PID:13620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        6⤵
        
        PID:15960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        6⤵
        
        PID:17664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
        6⤵
        
        PID:17920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
        5⤵
        
        PID:12228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46241.exe
        5⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        5⤵
        
        PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62089.exe
        5⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29795.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        6⤵
        
        PID:11660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        6⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55711.exe
        6⤵
        
        PID:17028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50240.exe
        6⤵
        
        PID:17948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11371.exe
        6⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37899.exe
        6⤵
        
        PID:17040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50936.exe
        6⤵
        
        PID:18080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
        5⤵
        
        PID:9300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
        5⤵
        
        PID:11832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11832 -s 216
        6⤵
        Program crash
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36758.exe
        5⤵
        
        PID:13596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        5⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        5⤵
        
        PID:17980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
      4⤵
      PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33355.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
        5⤵
        
        PID:13392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        5⤵
        
        PID:15812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        5⤵
        
        PID:17484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5157.exe
        5⤵
        
        PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64600.exe
      4⤵
      PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27961.exe
      4⤵
      PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65099.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41855.exe
      4⤵
      PID:14752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22475.exe
      4⤵
      PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe
      4⤵
      PID:17696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7688.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59925.exe
        7⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        8⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        8⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        8⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        8⤵
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        8⤵
        
        PID:17688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        8⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58148.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        7⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        6⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53043.exe
        7⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39944.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
        7⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        7⤵
        
        PID:17388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40380.exe
        7⤵
        
        PID:17512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17343.exe
        6⤵
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46433.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        6⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46727.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        7⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        7⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        7⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        7⤵
        
        PID:17760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        6⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11267.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14278.exe
        6⤵
        
        PID:15332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7131.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
        6⤵
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27756.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        6⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38459.exe
        6⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        6⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65040.exe
        6⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        6⤵
        
        PID:17656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
        5⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53080.exe
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24554.exe
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
        5⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11056.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        6⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        7⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63553.exe
        8⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        8⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24198.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        8⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        8⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
        7⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5911.exe
        7⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
        7⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45120.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2228.exe
        7⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54338.exe
        7⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
        6⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11880 -s 184
        7⤵
        Program crash
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36758.exe
        6⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38879.exe
        6⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        6⤵
        
        PID:17972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38907.exe
        5⤵
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        6⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        6⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        6⤵
        
        PID:17736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48907.exe
        5⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
        5⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exe
        5⤵
        
        PID:5096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 464
        6⤵
        Program crash
        
        PID:18352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        5⤵
        
        PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
      4⤵
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9427.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        6⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        6⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        6⤵
        
        PID:17704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61182.exe
        6⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40895.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        5⤵
        
        PID:13216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49795.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        5⤵
        
        PID:16860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
      4⤵
      PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4404.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50328.exe
        5⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
        5⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2119.exe
        5⤵
        
        PID:18148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
        5⤵
        
        PID:18140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
      4⤵
      PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
      4⤵
      PID:11296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
      4⤵
      PID:13880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33279.exe
      4⤵
      PID:15752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
      4⤵
      PID:18072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47709.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55405.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        6⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
        7⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42697.exe
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46184.exe
        8⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        8⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        8⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        8⤵
        
        PID:17596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29691.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21626.exe
        7⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe
        7⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45711.exe
        7⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        7⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        7⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17374.exe
        7⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        7⤵
        
        PID:17804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
        7⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24506.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7652.exe
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13906.exe
        6⤵
        
        PID:17304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        5⤵
        
        PID:412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61913.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28319.exe
        7⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31930.exe
        7⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        7⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34486.exe
        7⤵
        
        PID:17860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
        7⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
        6⤵
        
        PID:17456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
        6⤵
        
        PID:16540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24124.exe
        5⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
        5⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
        5⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        5⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        5⤵
        
        PID:9120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35347.exe
      4⤵
      Executes dropped EXE
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47303.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        6⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        6⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        6⤵
        
        PID:17648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        5⤵
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        5⤵
        
        PID:10436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33878.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33451.exe
        5⤵
        
        PID:15108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        5⤵
        
        PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27756.exe
      4⤵
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        5⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        5⤵
        
        PID:12224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14687.exe
        5⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        5⤵
        
        PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe
      4⤵
      PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53080.exe
      4⤵
      PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48249.exe
      4⤵
      PID:12680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
      4⤵
      PID:15196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46723.exe
      4⤵
      PID:7896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63116.exe
      4⤵
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22085.exe
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23843.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
        6⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        6⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        5⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39744.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        5⤵
        
        PID:12848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        5⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32212.exe
        5⤵
        
        PID:9824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
      4⤵
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
        5⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        5⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        5⤵
        
        PID:16196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        5⤵
        
        PID:17672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
      4⤵
      PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe
      4⤵
      PID:9768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51604.exe
      4⤵
      PID:12788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2556.exe
      4⤵
      PID:15160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47974.exe
      4⤵
      PID:17384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1934.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5680.exe
      4⤵
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        5⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        6⤵
        
        PID:14848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16495.exe
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        5⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60990.exe
        5⤵
        
        PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
      4⤵
      PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
      4⤵
      PID:11540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51663.exe
      4⤵
      PID:14708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
      4⤵
      PID:16948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
      4⤵
      PID:8248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59156.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe
      4⤵
      PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
      4⤵
      PID:10852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55895.exe
      4⤵
      PID:13820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe
      4⤵
      PID:15864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
      4⤵
      PID:17500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39045.exe
    3⤵
    PID:6268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48614.exe
    3⤵
    PID:9252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe
    3⤵
    PID:12608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe
    3⤵
    PID:15344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51584.exe
    3⤵
    PID:6708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5643.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5643.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41897.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39453.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
        7⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
        8⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
        8⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        8⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        8⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        8⤵
        
        PID:17752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
        8⤵
        
        PID:17872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe
        7⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe
        7⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26530.exe
        7⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7131.exe
        7⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        7⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        7⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        7⤵
        
        PID:17880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41721.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        6⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22195.exe
        6⤵
        
        PID:13184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49520.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        6⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        7⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        7⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39384.exe
        7⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60164.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58575.exe
        6⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30327.exe
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13252.exe
        6⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        6⤵
        
        PID:13604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        6⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        6⤵
        
        PID:17744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44845.exe
        6⤵
        
        PID:17968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        5⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4078.exe
        5⤵
        
        PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43435.exe
        5⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        5⤵
        
        PID:15280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51373.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        7⤵
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        7⤵
        
        PID:17424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        6⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe
        6⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
        6⤵
        
        PID:18052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42969.exe
        6⤵
        
        PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16221.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43888.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        6⤵
        
        PID:13908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        6⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        6⤵
        
        PID:17464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10850.exe
        5⤵
        
        PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        5⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe
        5⤵
        
        PID:18104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1802.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8628.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
        6⤵
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        6⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        6⤵
        
        PID:17060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
        6⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63271.exe
        5⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
        5⤵
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49063.exe
        5⤵
        
        PID:13228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        5⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        5⤵
        
        PID:8652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9883.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37409.exe
        5⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6747.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
        5⤵
        
        PID:14256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        5⤵
        
        PID:17000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42271.exe
        5⤵
        
        PID:18232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28367.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
      4⤵
      PID:10400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25898.exe
      4⤵
      PID:12496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40171.exe
      4⤵
      PID:9080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35649.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        6⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53043.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39944.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
        7⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        7⤵
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9936.exe
        7⤵
        
        PID:18312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31855.exe
        6⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe
        6⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
        6⤵
        
        PID:16212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65191.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37409.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        6⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7007.exe
        6⤵
        
        PID:17252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5322.exe
        6⤵
        
        PID:17856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3599.exe
        5⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46647.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
        5⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9676.exe
        5⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
        5⤵
        
        PID:9000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58700.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26937.exe
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        6⤵
        
        PID:11200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        6⤵
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        6⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        6⤵
        
        PID:17444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57970.exe
        6⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49099.exe
        5⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22063.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
        5⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17028.exe
        5⤵
        
        PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe
      4⤵
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        5⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23843.exe
        5⤵
        
        PID:10820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        5⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23240.exe
        5⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        5⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe
        5⤵
        
        PID:10664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
      4⤵
      PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59852.exe
      4⤵
      PID:10444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
      4⤵
      PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31300.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39453.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58700.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27321.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64063.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
        6⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        6⤵
        
        PID:17584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37829.exe
        6⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63271.exe
        5⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        6⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49063.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31507.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33355.exe
        5⤵
        
        PID:10952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29470.exe
        5⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        5⤵
        
        PID:15612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        5⤵
        
        PID:17556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
        5⤵
        
        PID:9812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41315.exe
      4⤵
      PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12743.exe
      4⤵
      PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47719.exe
      4⤵
      PID:12672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9995.exe
      4⤵
      PID:15292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
      4⤵
      PID:7532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64539.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe
      4⤵
      PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        5⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        5⤵
        
        PID:13868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        5⤵
        
        PID:17632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1818.exe
      4⤵
      PID:7704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53339.exe
      4⤵
      PID:13172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
      4⤵
      PID:8680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe
    3⤵
    PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
      4⤵
      PID:8904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
      4⤵
      PID:10620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55895.exe
      4⤵
      PID:13940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56872.exe
      4⤵
      PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
      4⤵
      PID:17728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
      4⤵
      PID:9228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
    3⤵
    PID:8136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50051.exe
    3⤵
    PID:10420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11743.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
    3⤵
    PID:15120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43436.exe
    3⤵
    PID:9068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29130.exe
    3⤵
    PID:17412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35279.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35279.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        6⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3084.exe
        8⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52140.exe
        8⤵
        
        PID:17904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
        8⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29795.exe
        7⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54132.exe
        7⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23318.exe
        7⤵
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        7⤵
        
        PID:17916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe
        7⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        6⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        6⤵
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14287.exe
        6⤵
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        6⤵
        
        PID:17924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62260.exe
        5⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47985.exe
        7⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exe
        7⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        7⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20482.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31014.exe
        6⤵
        
        PID:16988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50240.exe
        6⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57739.exe
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
        6⤵
        
        PID:12528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10322.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        5⤵
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-711.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        5⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
        5⤵
        
        PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52836.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
        5⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54003.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        6⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7122.exe
        6⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14287.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-692.exe
        6⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44196.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
        6⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        5⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61175.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        5⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38559.exe
        5⤵
        
        PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55959.exe
      4⤵
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42873.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31014.exe
        5⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54324.exe
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60444.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
      4⤵
      PID:9292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55968.exe
      4⤵
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59785.exe
      4⤵
      PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30626.exe
      4⤵
      PID:17096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40439.exe
      4⤵
      PID:17988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27843.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23501.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33309.exe
        5⤵
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        6⤵
        
        PID:716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 464
        7⤵
        Program crash
        
        PID:18336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
        6⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20807.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        6⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6643.exe
        5⤵
        
        PID:12460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10386.exe
        5⤵
        
        PID:15040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        5⤵
        
        PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7387.exe
      4⤵
      PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
        5⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        5⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19330.exe
        5⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        5⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        5⤵
        
        PID:17720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33146.exe
      4⤵
      PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2298.exe
      4⤵
      PID:10732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42039.exe
      4⤵
      PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35141.exe
      4⤵
      PID:14984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
      4⤵
      PID:6656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4734.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
      4⤵
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
        5⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16495.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35615.exe
        5⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        5⤵
        
        PID:14760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44611.exe
        5⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36677.exe
        5⤵
        
        PID:18236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44677.exe
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19731.exe
        5⤵
        
        PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        5⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
        5⤵
        
        PID:16816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28538.exe
      4⤵
      PID:9416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27692.exe
      4⤵
      PID:12116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
      4⤵
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
      4⤵
      PID:17200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
      4⤵
      PID:7748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23843.exe
      4⤵
      PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
      4⤵
      PID:13308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
      4⤵
      PID:15372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
      4⤵
      PID:9004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
    3⤵
    PID:7116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
    3⤵
    PID:10168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
    3⤵
    PID:12700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
    3⤵
    PID:15068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33511.exe
    3⤵
    PID:6776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60449.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65213.exe
        5⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        6⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        6⤵
        
        PID:12736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        6⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12136.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24699.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        6⤵
        
        PID:17156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe
        5⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47496.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44883.exe
        5⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55245.exe
        5⤵
        
        PID:8584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
      4⤵
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        5⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        5⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20482.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        5⤵
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        5⤵
        
        PID:17260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54324.exe
        5⤵
        
        PID:17520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8922.exe
      4⤵
      PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe
      4⤵
      PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
      4⤵
      PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45141.exe
      4⤵
      PID:17272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
      4⤵
      PID:16916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52836.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
      4⤵
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9995.exe
        5⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        5⤵
        
        PID:10284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12447.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        5⤵
        
        PID:17072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39259.exe
        5⤵
        
        PID:18240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
      4⤵
      PID:9236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe
      4⤵
      PID:11316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47496.exe
      4⤵
      PID:13476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
      4⤵
      PID:16640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
      4⤵
      PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
      4⤵
      PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
      4⤵
      PID:12244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56161.exe
      4⤵
      PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
      4⤵
      PID:16728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62492.exe
      4⤵
      PID:18300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
    3⤵
    PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42073.exe
      4⤵
      PID:17416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25505.exe
      4⤵
      PID:10656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53559.exe
    3⤵
    PID:8740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47799.exe
    3⤵
    PID:12272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48026.exe
    3⤵
    PID:13484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
    3⤵
    PID:16448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11056.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
      4⤵
      PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        6⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19083.exe
        6⤵
        
        PID:18160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe
        6⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29795.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        5⤵
        
        PID:11644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        5⤵
        
        PID:14244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63879.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        5⤵
        
        PID:17788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
        5⤵
        
        PID:10116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
      4⤵
      PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58893.exe
        5⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33275.exe
        5⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        5⤵
        
        PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
      4⤵
      PID:9244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46219.exe
      4⤵
      PID:12336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44639.exe
      4⤵
      PID:14900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
      4⤵
      PID:15424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56716.exe
      4⤵
      PID:9412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
    3⤵
    PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
      4⤵
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
      4⤵
      PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
      4⤵
      PID:12924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
      4⤵
      PID:14864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24970.exe
      4⤵
      PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38937.exe
      4⤵
      PID:9888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
    3⤵
    PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10904.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
      4⤵
      PID:6052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 464
        5⤵
        Program crash
        
        PID:18408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61023.exe
      4⤵
      PID:8852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
    3⤵
    PID:9164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exe
    3⤵
    PID:12280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30960.exe
    3⤵
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
    3⤵
    PID:16532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63241.exe
    3⤵
    PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
      4⤵
      PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8628.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36487.exe
        5⤵
        
        PID:11856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29382.exe
        5⤵
        
        PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7007.exe
        5⤵
        
        PID:17180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21658.exe
        5⤵
        
        PID:18220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61944.exe
      4⤵
      PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47719.exe
      4⤵
      PID:12648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe
      4⤵
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25697.exe
      4⤵
      PID:7608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
    3⤵
    PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
    3⤵
    PID:11752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 11752 -s 236
      4⤵
      Program crash
      PID:12128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
    3⤵
    PID:13756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
    3⤵
    PID:15940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18852.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18852.exe
  2⤵
  PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
    3⤵
    PID:7912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23075.exe
    3⤵
    PID:10060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
    3⤵
    PID:11416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34148.exe
    3⤵
    PID:15100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
    3⤵
    PID:6520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17514.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17514.exe
  2⤵
  PID:6204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43279.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43279.exe
  2⤵
  PID:8964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25583.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25583.exe
  2⤵
  PID:12632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38112.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38112.exe
  2⤵
  PID:15188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21131.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21131.exe
  2⤵
  PID:6552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 11752 -ip 11752
1⤵
PID:12120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 11880 -ip 11880
1⤵
PID:12208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 11832 -ip 11832
1⤵
PID:11280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6052 -ip 6052
1⤵
PID:18264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5452 -ip 5452
1⤵
PID:17188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5224 -ip 5224
1⤵
PID:17136

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:9984

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:10556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10163.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
Size 184KB
SHA256 d88df9541d2e95eac3671e3c3cbe61e9c003b19afff9c586f7b5c6ea7f2ae75a
MD5 9c8d6b95b68ca1c5e6032adf58f97f0d
SHA1 40ad08a7813f4e5817566639b9b2aa70daece914
SHA512 4b47ca63b76dc17c9b2c396e28a3098d2f93009f823fcb2a908269c0c036158a5b70d5bd1ecde40e50c348ea21a1c6e220f8460962fa6d15d7b3abde976d7ad4
SSDEEP 3072:tmBdBAoK7RU3kx9iFX9hhN8Lm3vvqgviuQ:tmeoZ09i5haLm3Xqgviu
TLSH
T12B048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-10952.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
Size 184KB
SHA256 ef98e6253fe8f9d23a4b75b39c7d679a3c71c1aa95406ac8dc40cb02a689bde5
MD5 e1017da82cd433cc3de7e3a7d23bad5d
SHA1 c3f5241986239be8e80055680ae22d09bcbcc7ec
SHA512 7a076d444bfc0ab38ef37a902551f94528231cfdf0dfb9f3ccee7ef5ffee821b86e902d09e6d6f07aa0cf9c766cd95a3393fc41e5274d31255d55b1be45e84d2
SSDEEP 3072:tmxdpAoK7RU3kx97FX9hhN8Lb3vvqgviuQ:tm2oZ0975haLb3Xqgviu
TLSH
T195048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-11371.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11371.exe
Size 184KB
SHA256 a451f821c84f645f05d7e085709b31ff85e0e14556131a61650ffb9be9446a87
MD5 191dad0399e70ccda81daa62a68969c5
SHA1 fe8ad50987957eb610111f905e00817e5c3c74ef
SHA512 e3f92c3234515a8bdaf920b27ca5c3a261530d61b2f30c8503305825ba65e4222e9da2b1a8a0a18347f97a59d2f6a07fe6d9ec4c2e88cbd5f6054a315c3fa3a3
SSDEEP 3072:HmBdBAoK7RU3kx97FX9hhNeLG3vvqgviuQ:HmeoZ0975hALG3Xqgviu
TLSH
T1FC048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-11407.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
Size 184KB
SHA256 63ebd385fc462d34e219fe51caeab3698db3cb1f505c58d072c6c0aee762550b
MD5 8d635f9878568e3ffff49799e780bad4
SHA1 c2d057c4b3561fbb3681054de3c292985afbfa89
SHA512 e7197409af30fa677ff33102e8c52d7ab8d844da22fc3eba3d5c99fc0c76f212c4e9b3cf47561e37f956d5f0be69556374875fe1b7aaaafcfc53873fba9d48f6
SSDEEP 3072:VmBdGAoK7yU3kx9iFX9hhN8LG3vvqgviuQ:Vm9oC09i5haLG3Xqgviu
TLSH
T10C048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-11699.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
Size 184KB
SHA256 daf52de0338569d68fce3acc3eb443f87e864f258eb83cd1168d4c010aa6369e
MD5 7c8b9d330972c251577d76a5b8d5ecb0
SHA1 88e5171e600dec9afe3064a65d6b884df3cc00b2
SHA512 3f79d7343590391599c7d370f569a7701f464f74d17f59bf60a7fd3ec9ef69116abc29ca10548e1d7343431affa058102ecc8110a820ce9fd82d2ca46524fb62
SSDEEP 3072:tmBdpAoK7RU3kx97FX9hhN8Lc3vvqgviuQ:tmGoZ0975haLc3Xqgviu
TLSH
T1A8048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-13500.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13500.exe
Size 184KB
SHA256 e255af87d1701752842b2ee8fbdc7da3921f7bb7792858c5cd23e53d6c2d6cdd
MD5 35f0f9947298112b0053ca8cbc5673f8
SHA1 d798c8510cb99c82c24984c97f124f89ddefa6f6
SHA512 f68483cbff606846c6d2d9e3016f5b17660bea5768c907221f32c48cf45f810585eec32d3975db1db80b93932bdcfc78d2fab825f3c93a59f793106d26e1aabb
SSDEEP 3072:tmBdGAoK7yU3kx9iFX9hhN8LG3vvqgviuQ:tm9oC09i5haLG3Xqgviu
TLSH
T102048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-15295.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
Size 184KB
SHA256 5e537f686021ed2fafdcd5d6eea3e577f1ef55b792a3d3ecb4858203393b8051
MD5 d6eb60eeb21c226875dcfbe664f7a2f4
SHA1 85eb1b765fedd0516d11fbdbe5761850737b7ae3
SHA512 8c0f97498a6ed9cd52e38339b5fe67a0a1e135029feb0c4b6cdcdf34263b45e5bfada1e572c29a77c5586d8a7407cfdaae271fe1fde7a70e2e6cd159429c7d4b
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8L13vvqgviuQ:tmeoZ0975haL13Xqgviu
TLSH
T187048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-1558.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
Size 184KB
SHA256 1403f1da206a57b43cf2a4a6437687a5f85f635db022e52c89c51ff79bd7c6a5
MD5 17eb4b305a190e375f093a6b375ca035
SHA1 3bf89c390e08796a57f343f9c7d975b1103c5ee8
SHA512 20286896edad9628be81a50ca57f54228469606f6d937b9937720cec9d5264ddfdadcddf09591c9fe14fdc5709c642b47f000d54f40a8683603353d02f1d9625
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8Lb3vvqgviuQ:tmeoZ0975haLb3Xqgviu
TLSH
T165048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18633.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18633.exe
Size 184KB
SHA256 1c51560c65d1918329ef51bb7226c323cd62c0d45135bf94a429c0e333572ce1
MD5 8906b8deb80012ee74cb0802a3a63e72
SHA1 0fe10070c634fae3d187c4fcc736275f5652aa3f
SHA512 d6645ed37a648954f3413ac616bc2a087b22cfecdfd1275d3fe8c56e721bc0f8ca0205da3ce27605397f6a0e6486179af9c72f4ef2cc164b2842298878cbfe80
SSDEEP 3072:tmBdBAoK7yU3kx9iFX9hhN8LG3vvqgviuQ:tmeoC09i5haLG3Xqgviu
TLSH
T173048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-24881.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe
Size 184KB
SHA256 2f04fc05adff2a76d636dac2bffc26b1af13b83d408b3a2a03453df5a1b85f5d
MD5 00be31644d899008b9a7d46d09ed0c78
SHA1 eb7384b6834db0cd0fdad45fdd5a5fba2b29edf7
SHA512 28ceb86470d0f756736fbc615554b1148ac1ba1d956ce2335f263ce720d3d4d224c4762004a62fc33c7e4b370f2ee2353e73a64e2b7512301ddacd85adb8e453
SSDEEP 3072:tmBdBAoK7RU3kx9iFX9hhN8LG3vvqgviuQ:tmeoZ09i5haLG3Xqgviu
TLSH
T176048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25627.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
Size 184KB
SHA256 ef71f8ba6e0175b2fc968606e01070929f8d18f675624556c0ea42c00c801dc5
MD5 6d0aad0a189731b4c602ed43114a14a7
SHA1 cdfe53991c66dfb2af1576553746539754923c72
SHA512 44c0f1e65545666d5a6661dcc8b4c7b5f368209b8ce0453fc651ab56259bf5e73012a4361fa51ba94d88695e158a16f8eecf55008bbc89bad561c0b1122b5951
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8Lu3vvqgviuQ:tmeoZ0975haLu3Xqgviu
TLSH
T1E7048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2592.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
Size 184KB
SHA256 740aa1d50da7e968768be490e75aecde7bf39c3bd26d21af1e32476169ab1e16
MD5 237f18ec0b5d0f690a230f47b37bff79
SHA1 846066de5235e361ad45f0176050e471b894d3b9
SHA512 ab55c7dc7d913a78076e37d211935b2cccb72127c5a2af6f06c7aedd8666b9f44d8a431858a8a750dad31fec0f3f43ace473f0d7a7d7621a185eb111afb45c67
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8L13vvqgviu7:tmeoZ0975haL13Xqgviu
TLSH
T18B048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-27843.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27843.exe
Size 184KB
SHA256 a5033e7ea216a885ac9b8e46dab73cfc9f4f574d4dc52ab4c325c6a9f8e682f7
MD5 e493bef90a7c6ff0f4105a29cee6f878
SHA1 fb3454e6d19fef5a2a2f7dfe20dfbb3459bbb564
SHA512 1a4945a1d6c77f6914e6fad1e632ac4a2f7cf098919e30b2e0221a83b46827744e3fb28beea3ae0511a8eb0c447d4427090ffef5385ace8023023cc47467cf39
SSDEEP 3072:tmBdBAoK7RU3kx97FXWhhN8Ly3vvqgviuQ:tmeoZ097IhaLy3Xqgviu
TLSH
T1E5048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-31300.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31300.exe
Size 184KB
SHA256 4e6a7418228f1672b4454c9869a97d87c6bf5957a49d000f887de4f59b04dbc3
MD5 080136f8f49ef1733b2fc08351a298ab
SHA1 2e8ae68c4cc287a8fe19f0c79a7448e0e721bcd3
SHA512 96612f14681626fe5b33ebd63351ef7c7f43b433c8792a7cfcb65d3d9f7cecd3c5e663631d3842a1b02e138ae354be3d336cf43048f04e20c6ed21b25bd903f9
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8LR3vvqgviuQ:tmeoZ0975haLR3Xqgviu
TLSH
T11B048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35279.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35279.exe
Size 184KB
SHA256 f5b4042ed78e8fd706354cf90ae0c994eadc73be438c192043285279b72e5612
MD5 b4d591c5601b7aef1e8e52e72dccffc6
SHA1 5d5ac292ef6b040d1d4acaf2a9c4f5e0e1b5fe6c
SHA512 0e1cd65c2de400fa20fd13979ffb496bd08a6fb855f0ab5c589e0cf96f18a28680a19d3ade98478259a1c15e88c7a878e8fe8fbc60b6c0d8386c0ecded32f952
SSDEEP 3072:tmBdBAoK7RU3kx97FXWhhN8L53vvqgviuQ:tmeoZ097IhaL53Xqgviu
TLSH
T146048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35649.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35649.exe
Size 184KB
SHA256 38e34e4f8656d6f8fe07188d1f08d1761307e2bf90a94affb4ad7945425322c2
MD5 3307b3063fc5d6ed180568b9f05213c2
SHA1 dd1a14bb825c80edf4c94818bc2a89045a08d37a
SHA512 89f4902e8f83d59a0481330101527dad09eab6506f364b1955c1322edf102b38cea2997e4dac79473e713cd8f892f4e94b49b736f609bfb43c165a0722c789b4
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8Lk3vvqgviuQ:tmeoZ0975haLk3Xqgviu
TLSH
T1EF048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-38315.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
Size 184KB
SHA256 dea4033c756b5aa0c2b51d9013d0070753d3b192138384271b046e5dff75545a
MD5 ee8677c1010fa88bfa40dae97e7c4ab7
SHA1 ff795791afa385a72ba4040759ee67767481a1c7
SHA512 037153be63b94467b8f9ac8e5441492f6c39c77bc6c10d15cbf68304cd19704052ba8721a696ee79900ece94567cf108e9d03ae98ebe48a2302c8d16fc831b5c
SSDEEP 3072:HmBdBAoK7RU3kx97FX9hhN8Lu3vvqgviuq:HmeoZ0975haLu3Xqgviu
TLSH
T1FD048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-38779.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
Size 184KB
SHA256 aee429db26ba987adfcd239a1d49d12df5243b9d63ad39f3c21606ba71ce5237
MD5 5339d44cba45df33cc0235a6a87cb0e6
SHA1 d2f3f90af4c6f13c3ba4f15d2e798edee2d5e555
SHA512 3b7bddc3ccb6cb82b4bbf55e8fa9509dfa292de0b6e8da1b33a32931709718bfeba03b6e595ea7c3429401a9cfab4146d5e7343e0f168e332a6b697b2ef6ec61
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8LI3vvqgviuQ:tmeoZ0975haLI3Xqgviu
TLSH
T142048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-39245.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39245.exe
Size 184KB
SHA256 f6b36e62d48131ad07ee022472fcb147ccfdfa31fb0b3e4a6a2bdcb9737c3bbd
MD5 8845f05bca67cce39479a38a4517cf6e
SHA1 fac6222ecf739713424a8c670b4a203f7c12598e
SHA512 67fce059894491d554a31210700668c47d097eeb2a0a1363268eb96a269058d0853c0fdf0c02a7f422237362beeba30678289c57412b9901b31da7ebb191fa91
SSDEEP 3072:tmBdBAoK7RU3kx97FXWhhN8L+3vvqgviuQ:tmeoZ097IhaL+3Xqgviu
TLSH
T117048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-39541.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
Size 184KB
SHA256 b5a55a733c533f09c19ac0ba563a013fb046c16780228049513927646ff2e461
MD5 832f261fa7cdd9687c2a1e7786a74b1c
SHA1 848a5566ccdb54126c4875e094828b7b5b746c5b
SHA512 a1db026c1082b9069d3a85f1d98a99e776db533a8f647477a8dbbf5bb7ee08dd706b98d9eff4a07ac8720df71562073cb7c7e8fb7ce1a92830d8754ee1f54d76
SSDEEP 3072:tmBdBAoK7RU3kx97FG9hhN8Ly3vvqgviuQ:tmeoZ0974haLy3Xqgviu
TLSH
T1DC048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-41897.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41897.exe
Size 184KB
SHA256 d86b07c9bd4f604bebec2020fde0d178d7ab7ac28dcd20c5ab184f487fe0fa0a
MD5 c28d6897bfbdbf50aa15e82c9c0bacd1
SHA1 bb519ffcbed4c94afce22c516fd8ce68316a5c76
SHA512 49e29cebbcf68669ca635664ccd2a8fc3b874d861a63eb978fdbbf82a80c21f12dd1ed477cc78f1f7e647d33c098e49c7e2750d4a3590032f5436b76bd220cf6
SSDEEP 3072:tmBdpAoK7RU3kx97FX9hhN8Lb3vvqgviuQ:tmGoZ0975haLb3Xqgviu
TLSH
T1B6048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42003.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42003.exe
Size 184KB
SHA256 cc8a048add4f5c5c24975acb7b2c3a390551ff5f8f4d2b102dd3dc09ae9df1ec
MD5 18d4e9ba41cbfc0d5e440f4dae604af4
SHA1 b6b3910e99fed1f27711237ff30762dbb2af6f4d
SHA512 8b4de28cb92f610015473eba788f71edffe9f821988f74bb31428d0a4f85b7a1f0d916ef2b83933fac83e241a0720a8981a6638b90c7c5119b9fded16f049d9b
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8L43vvqgviuQ:tmeoZ0975haL43Xqgviu
TLSH
T122048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43345.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
Size 184KB
SHA256 c90d1fce44e45f32f2649272e4878041bfe1bb4ddabdc5cdbea414ada90aefff
MD5 79ccf4e510ab56fd11dd06642dccce90
SHA1 2ea9d0dd9edc751bd14ed6f3ded7680600db3700
SHA512 01d714356a1ec37aca864d4f207b26cbd3b67b098b66108cf2c394ea80ff6a6b2c5d985ec993c2b522e78a364335e9961936d11e2c9acf6cd7d453e3fdd51c58
SSDEEP 3072:tmBdBAoK7RU3kx9iFX9hhN8L93vvqgviuQ:tmeoZ09i5haL93Xqgviu
TLSH
T1C4048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47709.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47709.exe
Size 184KB
SHA256 2fda97616ad0ed8b74ae4ee8c3e318117147f9d7a67bc23b61e27b0d9bb253b4
MD5 7e7f6d422da95285d0c819e5d1d0180c
SHA1 eaa4404ff1c8b7f37870b6515737bfec15587610
SHA512 3a59212b6fac472b406d4be489d90cf61e1c3272aada0e50c400f17d88fda4fe49227a2f02c51037302b29f9f4952274caec70f45ee07c5abad919dee4ef3d71
SSDEEP 3072:HmBdBAoK7RU3kx97FX9hhN8L/3vvqgviuQ:HmeoZ0975haL/3Xqgviu
TLSH
T121048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-48352.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
Size 184KB
SHA256 535af660112288b58bdfb9f146bde93013b3c70bf13a978465df4723fa4138d0
MD5 4b80fedf2de83eb0e9d7a1ca54147201
SHA1 d4807be0a91e793643bbc402b2e7e960f5ee0270
SHA512 6c92cf7588798e472c91a5824acabaf239bf3315f7d28e7786669b6d506d58a4d5ff99b9e4f3749510eca47aad93b50a6813993a759cf7619e91cea278fb59b9
SSDEEP 3072:tmBdpAoK7RU3kx97FX9hhN8Lx3vvqgviuQ:tmGoZ0975haLx3Xqgviu
TLSH
T10D048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-55405.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55405.exe
Size 184KB
SHA256 3a32839cafc1a5bed05d01b4675a813663f1c7eba2670d5a9ed07beafc6ec190
MD5 239963d5b9b76bf7562d79bf473d0ffd
SHA1 fa117d0f821afb28d99f45f71c51a86f80bf8ffb
SHA512 788f98a31d36628f69304f0a21e1cff73a312e754cb8a3ea139421a0316960fa6cb8840602ffbb67d3c79eb1b3f8c7fdbd91b697a8be52ca1d94c7bf9eb810fa
SSDEEP 3072:HmBdBAoK7RU3kx97FX9hhN8LF3vvqgviuQ:HmeoZ0975haLF3Xqgviu
TLSH
T1C3048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-5643.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5643.exe
Size 184KB
SHA256 2d3f1fc33efade4070af8bb534d80a3a244b7aa05c17c8ae6e036f6fec5e16b1
MD5 fa6447396318827042f85e983f3c912d
SHA1 41bc99c3b273e68ad16a2c8429f302489afdb17d
SHA512 eb9e80b4687acef8b8bd8c1abda932724a0e5573a1607a715632d21ce2a2221dc5a871489f79b123e7f0324461fcde251abd59429289b06becd3fe0f7d173496
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8Lx3vvqgviuQ:tmeoZ0975haLx3Xqgviu
TLSH
T165048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-57915.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
Size 184KB
SHA256 1f89b75219f0bb5b39d88020a5d4a2def33e41b3f36a91431e3411e055f36be6
MD5 c0e43fc1b9ab729ec5667f055a08a018
SHA1 b535e00d8dec71cad49826d7326b407801dea7cc
SHA512 052b7083f7a06d20b64cb91f79d0bf5ad42c1210fd1b8848480d7405af9fd224eb334746843c2e9f00a0940a26bd20a9bf00b1dfb271a9c71f38d9fcf126e2f3
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8LQ3vvqgviuQ:tmeoZ0975haLQ3Xqgviu
TLSH
T181048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59504.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe
Size 184KB
SHA256 e90477a744201e03c829ee11a0a6e7dced44dfbc742a9e5d87cb4335209ac4d0
MD5 2d79e49aba710d2952203c647d370fc4
SHA1 3de1e6634519e4e4dd02a17ab84857c386cf28f6
SHA512 499be169dbc057df04744de07eb9bac2821c7bc49a253d15da2e46f4116f762e1a1fb7ade3503131cb4c0d07d3fbd0855e17b139ad3106335e1261c2c54d89c1
SSDEEP 3072:tmBZBAoK7RU3kx97FX9hhN8L43vvqgviuQ:tmqoZ0975haL43Xqgviu
TLSH
T11B048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62457.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62457.exe
Size 184KB
SHA256 55451ef784dfc9f28cfbd9e16ccb18a58d0a12d720d82827d4baf41c93898836
MD5 5f03ac97e986fc93eab6c83f0094c656
SHA1 cb098f85a1a3fff4a2a7256b804bca3e7bda1a3e
SHA512 0f5b6a822062c22fb13c7f97dea6bcbb0c43b38c244a7ad1c6b7e9d2ad579f5e8e5cf7d55ec7aeb4950bcff7f7f4fbe58a0e35cc95ddce3c0c7dee69e2b46bb5
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8LG3vvqgviuQ:tmeoZ0975haLG3Xqgviu
TLSH
T16D048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-64163.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
Size 184KB
SHA256 97a97c5febba7ec0c89a4fa4c8de8ad5c4b00f448acfdbfb9b949f13aac29841
MD5 862e1ccc51a7b4174980ca001bc97ce7
SHA1 1c8df6f6dd3535b718c06e0cf065b29f37483ad9
SHA512 e72667ff4ee4c6c3c4508897ad475863728c0c7e10823ddddbd40d9d26427a21cec518871e43fb3e153bf62ed9db27466264bff65cc7b3d01936d96f8f138b26
SSDEEP 3072:tmBdBAoK7RU3kx97FX9hhN8Lx3vvqgviuQ:tmeoZ0975haLx3Xqgviu
TLSH
T114048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-64408.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
Size 184KB
SHA256 5e13708e87836bb98be6483ac5c7b23049b4a1ef0686dc10f1ba0bbd900866c4
MD5 7593aebcc763e352d7bb3abe766a9ee5
SHA1 79d9d7533b0a65942b069055a06717bc5bd5ea6f
SHA512 5fb1e8fef7eb14b9647da74df099253d647b77fd3533eccfca30e0391e1f6d1d4be3ec21ae941bb66984963df0d51cda2e1a2a732b483c04ceb34954065b079c
SSDEEP 3072:tmBdBAoK7RU3kx97FX9UhN8Lu3vvqgviuQ:tmeoZ097shaLu3Xqgviu
TLSH
T10D048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-7423.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
Size 184KB
SHA256 b68447e26cc972a27bae04a9dbdaf63143b7e7f8cc1375a94b2d74668b3efcda
MD5 6a97290ce83384659a0672e2e3391a5b
SHA1 1db7d2eef29b9b69d6761839f79bf8208fd07e96
SHA512 052f35dbd8352ee5b4ca84e83042194b00ce2639b65044d2a260bd2529031200087237269f50f88d2bb0f21ca0e12a759883adb5263648aff3ee8714f45506a7
SSDEEP 3072:tmBdBAoK7RU3kx97FG9hhN8L53vvqgviuQ:tmeoZ0974haL53Xqgviu
TLSH
T140048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-7688.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7688.exe
Size 184KB
SHA256 cd27d0eb9b4978df3d94ae27ade2e93a428a8283ff1eeebefc7ccaa655f4a6ea
MD5 bc5f3f22c8c696ef11972f8ee508ee2f
SHA1 75a2e1f9d3b79d901d36c528c53d99ab6959e892
SHA512 69e8d7d77cea6bdbf330cec4aff80ef2cc2630a7329d3dda8711fee5d44236522e12bcf0a1dad0985a7a1aaf91978915f6dfee006a770eec53645eda43afa8ff
SSDEEP 3072:HmBdBAoK7RU3kx97FX9hhN8Lu3vvqgviuQ:HmeoZ0975haLu3Xqgviu
TLSH
T14C048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads