d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe
Size 468KB
Sample241109-2a4mnstejb
SHA256 d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410
MD5 839970559641559da4878e3e0d900880
SHA1 314ad9816fa687d4798d4e1c85796ea164bb24d1
SHA512 72c7181f3b5be0fbe7dd6e2634fc82980cb4f0d9ca2f47e694bccac472a6a201815c53b6c9ba2e6c3b37e59a0ba44e18bd87de1665d36e74f48f0241bb0d9dd0
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUe0+bEj6o2ME:aphojNU26PDc4fEVzHUeDQj6o
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2160	Unicorn-37164.exe
3592	Unicorn-52514.exe
1052	Unicorn-24480.exe
4160	Unicorn-44128.exe
1344	Unicorn-54989.exe
4696	Unicorn-35960.exe
388	Unicorn-64640.exe
1548	Unicorn-49232.exe
740	Unicorn-34741.exe
2284	Unicorn-40872.exe
4732	Unicorn-40872.exe
1800	Unicorn-10145.exe
4300	Unicorn-32439.exe
3612	Unicorn-12838.exe
732	Unicorn-12838.exe
4308	Unicorn-34432.exe
3460	Unicorn-41208.exe
3004	Unicorn-56990.exe
1384	Unicorn-30247.exe
3000	Unicorn-64966.exe
4444	Unicorn-52449.exe
4000	Unicorn-13819.exe
216	Unicorn-32107.exe
1944	Unicorn-63596.exe
60	Unicorn-32870.exe
4908	Unicorn-8920.exe
2748	Unicorn-18571.exe
2860	Unicorn-24702.exe
3836	Unicorn-31478.exe
3928	Unicorn-27394.exe
3288	Unicorn-17110.exe
4668	Unicorn-50337.exe
2932	Unicorn-14156.exe
1900	Unicorn-29938.exe
3644	Unicorn-1157.exe
1204	Unicorn-41998.exe
1264	Unicorn-27699.exe
4020	Unicorn-51297.exe
3476	Unicorn-150.exe
1936	Unicorn-19750.exe
1724	Unicorn-50742.exe
2760	Unicorn-3487.exe
1060	Unicorn-64940.exe
1764	Unicorn-34214.exe
3660	Unicorn-29865.exe
5104	Unicorn-48604.exe
1704	Unicorn-53673.exe
1972	Unicorn-16294.exe
1492	Unicorn-27229.exe
1244	Unicorn-8126.exe
2764	Unicorn-58718.exe
2024	Unicorn-15740.exe
5012	Unicorn-47042.exe
2144	Unicorn-19008.exe
2272	Unicorn-19008.exe
776	Unicorn-38874.exe
4832	Unicorn-24575.exe
440	Unicorn-20491.exe
1716	Unicorn-20491.exe
2440	Unicorn-4447.exe
2716	Unicorn-31090.exe
4748	Unicorn-37866.exe
1844	Unicorn-12707.exe
3864	Unicorn-47234.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
14784	7788	WerFault.exe	320
14820	6008	WerFault.exe	264
14988	7772	WerFault.exe	319

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45257.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	14208	dwm.exe
Token: SeChangeNotifyPrivilege	14208	dwm.exe
Token: 33	14208	dwm.exe
Token: SeIncBasePriorityPrivilege	14208	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe
2160	Unicorn-37164.exe
3592	Unicorn-52514.exe
1052	Unicorn-24480.exe
4160	Unicorn-44128.exe
1344	Unicorn-54989.exe
388	Unicorn-64640.exe
4696	Unicorn-35960.exe
1548	Unicorn-49232.exe
3612	Unicorn-12838.exe
740	Unicorn-34741.exe
4732	Unicorn-40872.exe
732	Unicorn-12838.exe
1800	Unicorn-10145.exe
2284	Unicorn-40872.exe
4300	Unicorn-32439.exe
4308	Unicorn-34432.exe
3004	Unicorn-56990.exe
3460	Unicorn-41208.exe
1384	Unicorn-30247.exe
216	Unicorn-32107.exe
4000	Unicorn-13819.exe
4444	Unicorn-52449.exe
1944	Unicorn-63596.exe
2748	Unicorn-18571.exe
3928	Unicorn-27394.exe
60	Unicorn-32870.exe
2860	Unicorn-24702.exe
4908	Unicorn-8920.exe
3836	Unicorn-31478.exe
3288	Unicorn-17110.exe
4668	Unicorn-50337.exe
1900	Unicorn-29938.exe
2932	Unicorn-14156.exe
3644	Unicorn-1157.exe
4816	Unicorn-15547.exe
1204	Unicorn-41998.exe
1264	Unicorn-27699.exe
4020	Unicorn-51297.exe
1724	Unicorn-50742.exe
3476	Unicorn-150.exe
1936	Unicorn-19750.exe
1764	Unicorn-34214.exe
1060	Unicorn-64940.exe
3660	Unicorn-29865.exe
2760	Unicorn-3487.exe
5104	Unicorn-48604.exe
1704	Unicorn-53673.exe
1492	Unicorn-27229.exe
1244	Unicorn-8126.exe
1972	Unicorn-16294.exe
2024	Unicorn-15740.exe
2764	Unicorn-58718.exe
1716	Unicorn-20491.exe
440	Unicorn-20491.exe
776	Unicorn-38874.exe
2144	Unicorn-19008.exe
2272	Unicorn-19008.exe
5012	Unicorn-47042.exe
4832	Unicorn-24575.exe
1844	Unicorn-12707.exe
4748	Unicorn-37866.exe
2716	Unicorn-31090.exe
2440	Unicorn-4447.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2160	1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe	88
PID 1372 wrote to memory of 2160	1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe	88
PID 1372 wrote to memory of 2160	1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe	88
PID 2160 wrote to memory of 3592	2160	Unicorn-37164.exe	94
PID 2160 wrote to memory of 3592	2160	Unicorn-37164.exe	94
PID 2160 wrote to memory of 3592	2160	Unicorn-37164.exe	94
PID 1372 wrote to memory of 1052	1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe	95
PID 1372 wrote to memory of 1052	1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe	95
PID 1372 wrote to memory of 1052	1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe	95
PID 3592 wrote to memory of 4160	3592	Unicorn-52514.exe	100
PID 3592 wrote to memory of 4160	3592	Unicorn-52514.exe	100
PID 3592 wrote to memory of 4160	3592	Unicorn-52514.exe	100
PID 2160 wrote to memory of 1344	2160	Unicorn-37164.exe	101
PID 2160 wrote to memory of 1344	2160	Unicorn-37164.exe	101
PID 2160 wrote to memory of 1344	2160	Unicorn-37164.exe	101
PID 1052 wrote to memory of 4696	1052	Unicorn-24480.exe	102
PID 1052 wrote to memory of 4696	1052	Unicorn-24480.exe	102
PID 1052 wrote to memory of 4696	1052	Unicorn-24480.exe	102
PID 1372 wrote to memory of 388	1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe	103
PID 1372 wrote to memory of 388	1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe	103
PID 1372 wrote to memory of 388	1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe	103
PID 1344 wrote to memory of 1548	1344	Unicorn-54989.exe	104
PID 1344 wrote to memory of 1548	1344	Unicorn-54989.exe	104
PID 1344 wrote to memory of 1548	1344	Unicorn-54989.exe	104
PID 2160 wrote to memory of 740	2160	Unicorn-37164.exe	105
PID 2160 wrote to memory of 740	2160	Unicorn-37164.exe	105
PID 2160 wrote to memory of 740	2160	Unicorn-37164.exe	105
PID 388 wrote to memory of 2284	388	Unicorn-64640.exe	107
PID 388 wrote to memory of 2284	388	Unicorn-64640.exe	107
PID 388 wrote to memory of 2284	388	Unicorn-64640.exe	107
PID 4696 wrote to memory of 4732	4696	Unicorn-35960.exe	106
PID 4696 wrote to memory of 4732	4696	Unicorn-35960.exe	106
PID 4696 wrote to memory of 4732	4696	Unicorn-35960.exe	106
PID 4160 wrote to memory of 1800	4160	Unicorn-44128.exe	108
PID 4160 wrote to memory of 1800	4160	Unicorn-44128.exe	108
PID 4160 wrote to memory of 1800	4160	Unicorn-44128.exe	108
PID 1372 wrote to memory of 4300	1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe	109
PID 1372 wrote to memory of 4300	1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe	109
PID 1372 wrote to memory of 4300	1372	d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe	109
PID 1052 wrote to memory of 732	1052	Unicorn-24480.exe	111
PID 1052 wrote to memory of 732	1052	Unicorn-24480.exe	111
PID 1052 wrote to memory of 732	1052	Unicorn-24480.exe	111
PID 3592 wrote to memory of 3612	3592	Unicorn-52514.exe	110
PID 3592 wrote to memory of 3612	3592	Unicorn-52514.exe	110
PID 3592 wrote to memory of 3612	3592	Unicorn-52514.exe	110
PID 1548 wrote to memory of 4308	1548	Unicorn-49232.exe	112
PID 1548 wrote to memory of 4308	1548	Unicorn-49232.exe	112
PID 1548 wrote to memory of 4308	1548	Unicorn-49232.exe	112
PID 1344 wrote to memory of 3460	1344	Unicorn-54989.exe	113
PID 1344 wrote to memory of 3460	1344	Unicorn-54989.exe	113
PID 1344 wrote to memory of 3460	1344	Unicorn-54989.exe	113
PID 3612 wrote to memory of 3004	3612	Unicorn-12838.exe	114
PID 3612 wrote to memory of 3004	3612	Unicorn-12838.exe	114
PID 3612 wrote to memory of 3004	3612	Unicorn-12838.exe	114
PID 3592 wrote to memory of 1384	3592	Unicorn-52514.exe	115
PID 3592 wrote to memory of 1384	3592	Unicorn-52514.exe	115
PID 3592 wrote to memory of 1384	3592	Unicorn-52514.exe	115
PID 740 wrote to memory of 3000	740	Unicorn-34741.exe	116
PID 740 wrote to memory of 3000	740	Unicorn-34741.exe	116
PID 740 wrote to memory of 3000	740	Unicorn-34741.exe	116
PID 2160 wrote to memory of 4444	2160	Unicorn-37164.exe	117
PID 2160 wrote to memory of 4444	2160	Unicorn-37164.exe	117
PID 2160 wrote to memory of 4444	2160	Unicorn-37164.exe	117
PID 4300 wrote to memory of 4000	4300	Unicorn-32439.exe	118

C:\Users\Admin\AppData\Local\Temp\d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe
"C:\Users\Admin\AppData\Local\Temp\d698901e8fb7d67a10c1b490efc72be8153d67bae27c6d10485102af5fc63410N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10145.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14156.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
        7⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        9⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25128.exe
        10⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        10⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        9⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        8⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        8⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60972.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        8⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        8⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8099.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50223.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        7⤵
        
        PID:17264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
        6⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44795.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62963.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
        9⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        9⤵
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47612.exe
        8⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        8⤵
        
        PID:17160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53564.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42450.exe
        8⤵
        
        PID:14284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe
        8⤵
        
        PID:18756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28589.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31153.exe
        7⤵
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
        6⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54790.exe
        7⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1178.exe
        7⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exe
        7⤵
        
        PID:16276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44147.exe
        7⤵
        
        PID:19212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3388.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64802.exe
        6⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47042.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10067.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30810.exe
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44702.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
        9⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60466.exe
        9⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
        8⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29521.exe
        8⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
        8⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46907.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        8⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46076.exe
        8⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2007.exe
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27603.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        7⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        7⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        7⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        7⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        6⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21514.exe
        6⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56058.exe
        6⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25463.exe
        7⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe
        7⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32673.exe
        6⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55528.exe
        6⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39315.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        6⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
        6⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44194.exe
        5⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9782.exe
        6⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22073.exe
        5⤵
        
        PID:18816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12838.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1157.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
        7⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe
        8⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14255.exe
        9⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        9⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-575.exe
        9⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65163.exe
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
        9⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9782.exe
        9⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        8⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18884.exe
        8⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        8⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24093.exe
        8⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9912.exe
        8⤵
        
        PID:17424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        7⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15834.exe
        8⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58391.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56104.exe
        7⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
        6⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39580.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25522.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1801.exe
        9⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36808.exe
        9⤵
        
        PID:16796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        9⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
        8⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
        8⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1609.exe
        8⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59367.exe
        8⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        8⤵
        
        PID:19288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        7⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
        7⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        7⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
        7⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
        6⤵
        
        PID:12760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18380.exe
        6⤵
        
        PID:15616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13453.exe
        6⤵
        
        PID:18960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-150.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        6⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        8⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        9⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        9⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30123.exe
        9⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
        9⤵
        
        PID:19044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8666.exe
        8⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
        8⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40850.exe
        7⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4887.exe
        7⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        7⤵
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        6⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29544.exe
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        7⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        7⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49672.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31189.exe
        6⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        6⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        6⤵
        
        PID:19104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
        7⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        7⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2880.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40850.exe
        6⤵
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17007.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11494.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        6⤵
        
        PID:13224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        5⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24960.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30247.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39642.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
        8⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24168.exe
        9⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        9⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        9⤵
        
        PID:18948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        8⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe
        8⤵
        
        PID:17012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25128.exe
        8⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38370.exe
        8⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52526.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7400.exe
        7⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56190.exe
        7⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47945.exe
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        6⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65443.exe
        6⤵
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        5⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14307.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        7⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
        8⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
        8⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
        8⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21588.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        7⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5262.exe
        7⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31973.exe
        7⤵
        
        PID:19352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27930.exe
        7⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        7⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42366.exe
        7⤵
        
        PID:19220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58521.exe
        6⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53678.exe
        5⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3155.exe
        6⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
        5⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
        6⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37473.exe
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37190.exe
        5⤵
        
        PID:18604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19750.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60555.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        6⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        7⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        6⤵
        
        PID:14064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64001.exe
        6⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5001.exe
        5⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20290.exe
        5⤵
        
        PID:11088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
        5⤵
        
        PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        5⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33684.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25463.exe
        6⤵
        
        PID:15960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21588.exe
        6⤵
        
        PID:180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18998.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26397.exe
        5⤵
        
        PID:13596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        5⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17007.exe
        5⤵
        
        PID:19060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7072.exe
      4⤵
      PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe
      4⤵
      PID:10428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2358.exe
      4⤵
      PID:1564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63508.exe
        8⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        9⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1287.exe
        10⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62210.exe
        10⤵
        
        PID:18784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe
        9⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24706.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
        8⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        8⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24374.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38174.exe
        9⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        9⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        9⤵
        
        PID:18968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        8⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        8⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17007.exe
        8⤵
        
        PID:19052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62754.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        7⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49114.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        8⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11785.exe
        9⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        9⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        9⤵
        
        PID:18940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18998.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26397.exe
        8⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        8⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47734.exe
        8⤵
        
        PID:19180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12672.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3363.exe
        8⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        8⤵
        
        PID:18632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        7⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        7⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        7⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        7⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exe
        7⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48775.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15832.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
        6⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25363.exe
        6⤵
        
        PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31090.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59180.exe
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16384.exe
        9⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        9⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        9⤵
        
        PID:19024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        8⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
        8⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        7⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        7⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44524.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        7⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        7⤵
        
        PID:18624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28250.exe
        6⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7241.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12707.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28177.exe
        8⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30333.exe
        8⤵
        
        PID:18560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        7⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
        7⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46295.exe
        7⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8839.exe
        7⤵
        
        PID:19280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38136.exe
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        6⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12672.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6959.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        6⤵
        
        PID:16860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61059.exe
        6⤵
        
        PID:18672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38888.exe
        5⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45342.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45539.exe
        5⤵
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47234.exe
        6⤵
        Executes dropped EXE
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30836.exe
        7⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        9⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        9⤵
        
        PID:18804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        8⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        8⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58521.exe
        7⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53966.exe
        7⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        7⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        7⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
        7⤵
        
        PID:19072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34549.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62475.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
        6⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36866.exe
        6⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18340.exe
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7089.exe
        8⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        7⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25107.exe
        7⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        6⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        6⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        5⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34474.exe
        6⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11536.exe
        6⤵
        
        PID:464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62414.exe
        5⤵
        
        PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57825.exe
        5⤵
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17739.exe
        5⤵
        
        PID:17136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31474.exe
        5⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        7⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19049.exe
        7⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62475.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        6⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
        6⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        6⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51245.exe
        5⤵
        
        PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49683.exe
      4⤵
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
        5⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
        6⤵
        
        PID:17344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        5⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35387.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37629.exe
        5⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4556.exe
        5⤵
        
        PID:19132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
      4⤵
      PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
        5⤵
        
        PID:7788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7788 -s 632
        6⤵
        Program crash
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        5⤵
        
        PID:16780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21667.exe
        5⤵
        
        PID:10676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51203.exe
      4⤵
      PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
      4⤵
      PID:11180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15669.exe
      4⤵
      PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64966.exe
      4⤵
      Executes dropped EXE
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12760.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29440.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61116.exe
        8⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
        8⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7555.exe
        8⤵
        
        PID:19296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52168.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27193.exe
        7⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56104.exe
        7⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        7⤵
        
        PID:19444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24461.exe
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24602.exe
        6⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30082.exe
        5⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6476.exe
        6⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29596.exe
        7⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24172.exe
        7⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        6⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
        6⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
        6⤵
        
        PID:16148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        6⤵
        
        PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
        5⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17152.exe
        6⤵
        
        PID:14936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        6⤵
        
        PID:17256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
        5⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58004.exe
        5⤵
        
        PID:15772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45783.exe
        5⤵
        
        PID:19332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51297.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55978.exe
        5⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17103.exe
        7⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        6⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30198.exe
        7⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        7⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
        7⤵
        
        PID:18888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21799.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        6⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12923.exe
        6⤵
        
        PID:19372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        7⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        7⤵
        
        PID:15780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13787.exe
        6⤵
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29757.exe
        6⤵
        
        PID:19140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe
        5⤵
        
        PID:13320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        5⤵
        
        PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41488.exe
      4⤵
      PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53202.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49699.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        6⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3902.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4686.exe
        5⤵
        
        PID:15652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11381.exe
      4⤵
      PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15870.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe
        5⤵
        
        PID:18928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39656.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51756.exe
      4⤵
      PID:12664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52449.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48604.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2029.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32258.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
        7⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
        7⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43232.exe
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23711.exe
        6⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55528.exe
        6⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
        5⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe
        5⤵
        
        PID:11208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exe
        5⤵
        
        PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27882.exe
      4⤵
      PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe
        5⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43896.exe
      4⤵
      PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47588.exe
      4⤵
      PID:11156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55713.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27229.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
      4⤵
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9019.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33684.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37716.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44147.exe
        6⤵
        
        PID:19204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe
        5⤵
        
        PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59481.exe
        5⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49114.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
      4⤵
      PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17868.exe
        5⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        5⤵
        
        PID:15728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8805.exe
      4⤵
      PID:9680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
      4⤵
      PID:13360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21293.exe
      4⤵
      PID:16196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
      4⤵
      PID:19324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60601.exe
    3⤵
    PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13103.exe
      4⤵
      PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        5⤵
        
        PID:368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44914.exe
        5⤵
        
        PID:18564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23274.exe
      4⤵
      PID:9324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
      4⤵
      PID:544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
      4⤵
      PID:17048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
    3⤵
    PID:7396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28444.exe
      4⤵
      PID:13684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3944.exe
      4⤵
      PID:17228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53447.exe
    3⤵
    PID:9508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
    3⤵
    PID:15192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37284.exe
    3⤵
    PID:1432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35960.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58718.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        8⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe
        9⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
        9⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        9⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exe
        9⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        8⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        8⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
        8⤵
        
        PID:17020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46820.exe
        7⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59221.exe
        7⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44790.exe
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19378.exe
        8⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        8⤵
        
        PID:18616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        7⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        7⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20290.exe
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
        6⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
        7⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        8⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
        7⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49621.exe
        6⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        7⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        7⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31085.exe
        6⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61366.exe
        6⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14696.exe
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exe
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12926.exe
        5⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32504.exe
        5⤵
        
        PID:19312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        6⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-825.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe
        8⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36746.exe
        8⤵
        
        PID:18576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
        7⤵
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33258.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        6⤵
        
        PID:15740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        6⤵
        
        PID:19384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
        6⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        6⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
        5⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24575.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        6⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
        6⤵
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        5⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        5⤵
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63312.exe
        5⤵
        
        PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32517.exe
      4⤵
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        5⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
        6⤵
        
        PID:12228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44785.exe
        6⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
      4⤵
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
      4⤵
      PID:11200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22425.exe
      4⤵
      PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12838.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:60
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50524.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61116.exe
        8⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        8⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38282.exe
        8⤵
        
        PID:19084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16092.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29521.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        7⤵
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        6⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        7⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        7⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
        7⤵
        
        PID:18900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32733.exe
        6⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31687.exe
        6⤵
        
        PID:12884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43642.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        6⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        7⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22226.exe
        7⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2636.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40388.exe
        5⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        6⤵
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26694.exe
        6⤵
        
        PID:16868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        6⤵
        
        PID:10848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
        5⤵
        
        PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        6⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe
        6⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49621.exe
        5⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        5⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59420.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
      4⤵
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8163.exe
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8988.exe
        5⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
        5⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        5⤵
        
        PID:19416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
      4⤵
      PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28276.exe
      4⤵
      PID:13116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
      4⤵
      PID:7008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5023.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
        6⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe
        7⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        7⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19661.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        6⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36057.exe
        6⤵
        
        PID:18712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe
        5⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44204.exe
        6⤵
        
        PID:13408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        6⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        5⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        5⤵
        
        PID:17184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43102.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45854.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
        6⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13787.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        6⤵
        
        PID:19260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47316.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23711.exe
        5⤵
        
        PID:14112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
        5⤵
        
        PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
      4⤵
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19378.exe
        5⤵
        
        PID:11868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7872.exe
      4⤵
      PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63254.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        5⤵
        
        PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15045.exe
      4⤵
      PID:14120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
      4⤵
      PID:17196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26020.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36840.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58656.exe
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22610.exe
        6⤵
        
        PID:17236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18640.exe
        5⤵
        
        PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        5⤵
        
        PID:15876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
        5⤵
        
        PID:19012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19762.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28640.exe
        5⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        5⤵
        
        PID:19188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52003.exe
      4⤵
      PID:10196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40510.exe
      4⤵
      PID:14524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
      4⤵
      PID:1296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
    3⤵
    PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
      4⤵
      PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22030.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47115.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
      4⤵
      PID:9100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19791.exe
      4⤵
      PID:12828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
      4⤵
      PID:5240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57451.exe
    3⤵
    PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30260.exe
      4⤵
      PID:12336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40316.exe
      4⤵
      PID:14960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2643.exe
    3⤵
    PID:2712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58019.exe
    3⤵
    PID:10636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
    3⤵
    PID:16908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11759.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        8⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
        8⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50945.exe
        8⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15438.exe
        7⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36086.exe
        7⤵
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
        6⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        7⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33953.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22427.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39855.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33545.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22232.exe
        6⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13731.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40316.exe
        7⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        6⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13169.exe
        5⤵
        
        PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55101.exe
        5⤵
        
        PID:11192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
        5⤵
        
        PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        6⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        7⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3481.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        7⤵
        
        PID:19252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49751.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26807.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19398.exe
        6⤵
        
        PID:16036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        5⤵
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44956.exe
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
        6⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32759.exe
        5⤵
        
        PID:9120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
        5⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        5⤵
        
        PID:16772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe
        5⤵
        
        PID:10984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        5⤵
        
        PID:7772
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 640
        6⤵
        Program crash
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61375.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61287.exe
        5⤵
        
        PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exe
      4⤵
      PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
      4⤵
      PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
      4⤵
      PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61544.exe
      4⤵
      PID:19396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8920.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38874.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        6⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11711.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20778.exe
        6⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        6⤵
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10726.exe
        5⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23963.exe
        5⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20778.exe
        5⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64272.exe
        5⤵
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
        5⤵
        
        PID:19000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
      4⤵
      PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        5⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        5⤵
        
        PID:13144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13403.exe
        5⤵
        
        PID:14472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43669.exe
      4⤵
      PID:8300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
      4⤵
      PID:13040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22848.exe
      4⤵
      PID:16112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
      4⤵
      PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe
        6⤵
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1535.exe
        6⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        5⤵
        
        PID:15108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41330.exe
        5⤵
        
        PID:14892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12672.exe
      4⤵
      PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        5⤵
        
        PID:14560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32261.exe
        5⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20218.exe
        5⤵
        
        PID:10264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20455.exe
      4⤵
      PID:10576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18884.exe
      4⤵
      PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59543.exe
    3⤵
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe
      4⤵
      PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
      4⤵
      PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
      4⤵
      PID:580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25143.exe
    3⤵
    PID:6976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
    3⤵
    PID:11316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49068.exe
    3⤵
    PID:4820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9019.exe
        6⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13731.exe
        7⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61313.exe
        7⤵
        
        PID:17128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
        5⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54022.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        6⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe
        6⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7627.exe
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20778.exe
        5⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61558.exe
        5⤵
        
        PID:15628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
      4⤵
      PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58386.exe
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        5⤵
        
        PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22645.exe
      4⤵
      PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34286.exe
        5⤵
        
        PID:14784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
      4⤵
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64272.exe
      4⤵
      PID:16120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23030.exe
      4⤵
      PID:18988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8126.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
      4⤵
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        6⤵
        
        PID:14440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21091.exe
        6⤵
        
        PID:19164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23274.exe
        5⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46295.exe
        5⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
        5⤵
        
        PID:19116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
      4⤵
      PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11785.exe
        5⤵
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16388.exe
        5⤵
        
        PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
      4⤵
      PID:10336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63504.exe
      4⤵
      PID:4520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57378.exe
    3⤵
    PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
      4⤵
      PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28506.exe
        5⤵
        
        PID:11484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63451.exe
        5⤵
        
        PID:16812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
      4⤵
      PID:1452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46253.exe
    3⤵
    PID:7500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36897.exe
    3⤵
    PID:10316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32578.exe
    3⤵
    PID:872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
      4⤵
      PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54572.exe
        6⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        6⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
        6⤵
        
        PID:19032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17130.exe
        5⤵
        
        PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
      4⤵
      PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
      4⤵
      PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20134.exe
      4⤵
      PID:14796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2070.exe
    3⤵
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28672.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13373.exe
        5⤵
        
        PID:9268
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 652
        5⤵
        Program crash
        
        PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
      4⤵
      PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
      4⤵
      PID:14156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe
      4⤵
      PID:16900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
      4⤵
      PID:8748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
    3⤵
    PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
      4⤵
      PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
      4⤵
      PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
      4⤵
      PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60483.exe
      4⤵
      PID:19156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38599.exe
    3⤵
    PID:9488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
    3⤵
    PID:13344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24602.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53673.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53673.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exe
    3⤵
    PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
      4⤵
      PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20254.exe
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7565.exe
        5⤵
        
        PID:16404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
      4⤵
      PID:10180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
      4⤵
      PID:14184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48241.exe
      4⤵
      PID:16392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
    3⤵
    PID:6516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
    3⤵
    PID:10792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26477.exe
    3⤵
    PID:2372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51408.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51408.exe
  2⤵
  PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17868.exe
    3⤵
    PID:9348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26476.exe
    3⤵
    PID:11900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19625.exe
    3⤵
    PID:5352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
  2⤵
  PID:8460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3546.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3546.exe
  2⤵
  PID:10752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21524.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21524.exe
  2⤵
  PID:16804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 7788 -ip 7788
1⤵
PID:14248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7772 -ip 7772
1⤵
PID:13440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6008 -ip 6008
1⤵
PID:14260

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10145.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10145.exe
Size 468KB
SHA256 8b0d7f495c7221c7d809cc8750e43757cd65529adda2b56176e22e599e6f1b81
MD5 d57b1755ee3ed1cd7b1a1940902faf14
SHA1 de0fd21c5dc0406b1d45397a62dc8d80aae3f9f9
SHA512 674ef0408bc1554a28c12bf0292ec59cb0752086aeffa990e0335f783f28c24917e304ea62748435893d6215be31f85cbbc445d9efb0a0d515ffc01a5fe83cb6
SSDEEP 3072:apnhoggxjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUO0+lEH6o2ME:aphovNU26PDc4fEVzHUODWH6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-12838.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12838.exe
Size 468KB
SHA256 8f7bd4084f45eee599af1a7ed3d3ea410ca9c1a3c0bde4c1cebcc10e63854ca6
MD5 5a3d74f466e0f5e521b3d05632b8995b
SHA1 743561282a7246e6b0d363c544eb0ddb44dddb94
SHA512 9a8658795fd5305ea48041391a31a081fe54222070f35b9a54dbda46d58084338ecc4fc5145a876ebfd48c73f77ff940855f0032709f073392b464fb1deb445a
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUO0+gEH6o2ME:aphojNU26PDc4fEVzHUODRH6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-13819.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13819.exe
Size 468KB
SHA256 9b9e39210964f2a58e9022de770d919fd3c9ead5ed529f53bb31af027e799607
MD5 5495840bd36260154e070537a8d0c084
SHA1 52675a7a770970c80fc71d9f1d2ed34be85f3af6
SHA512 af96c03dc1f844f2eefc5f496e4163d198aa2b5b1da99203e098d402ede4e014ba4f47660b61c7ff86042909ab40bc8acb9600751b50d3f4041a0f75e0ed1306
SSDEEP 3072:apnhog0xjg8U2bYsPz3c4f8/EZ3jyIgZrwfI+V9MUe0+b2j6o2ME:aphojNU2vPDc4fEVzHUeDqj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-14156.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14156.exe
Size 468KB
SHA256 02aefc0c10bf54ca8deb250497491da5c0d56b32973a3e2e96673633ce53518f
MD5 db3a49549910cc66b5c8c6aa008e1674
SHA1 90280199ca501e0a9a140245cc26c8e410b2507b
SHA512 54deded1796e73f4ce9f8a395b66f4622d8367ca137b45cbe0db64414dcd595fc0156afe7538db4ed531009e58428351bbe38b6d409dd40940c1dbd936013642
SSDEEP 3072:apnhoggxjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUO0+zEH6o2ME:aphovNU26PDc4fEVzHUOD4H6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-17110.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
Size 468KB
SHA256 d420efd565b410f6c63e98f3ea7fd00589e230348005aeb05a3430da9138c96b
MD5 3869816c3775892f5e19990cc191f924
SHA1 32c26b047ee33e405168deaa68ca4e2548b4e422
SHA512 7f6473fffa9bfb37bcb8e7c6e8b172ba367e1bca09688da2fe8c24012aa2e0d8c04fd7d56293c9f8ab3976de50fe812e7fdd689eea1e76e0be379eb37fae231f
SSDEEP 3072:apnhog0xjg8U2bY5Pz3cjf8/EZ3fyIgZrwfI+V9M+O0+bZj6o2ME:aphojNU26PDcjfwVzH+ODVj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-18571.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
Size 468KB
SHA256 7e4b23415bd1141ee16ad087928895fdc14f3ed50a3bf8bf331907fba4fc0766
MD5 ed9bad8dd8f71570e8038f54363e168e
SHA1 99ab5b464d4ba7c6f27e136970c11485b4641350
SHA512 afec14a9a368301fec92761dd91c57d127b128e705f5241724bf0a7494228f1554a27821e1bdc76bbaa038ee0a44e5824dd20d7b9af1d09f1eebfae4c93106d7
SSDEEP 3072:apnhog0xjg8t2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUe0+bEB6o2ME:aphojNt26PDc4fEVzHUeDQB6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-22040.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
Size 468KB
SHA256 c40e4220e8c94a9fdb1942c7e5a27908baf03fee954b0e68437a6cce7803128e
MD5 65e0fd4ea1fa3bbbe0c3d217c728fb7c
SHA1 f688cdafe1f63ab37ff1c7dce533a787a5132473
SHA512 4237a8ab7f160d3cac9a50cde694eb955c0cd326c3575347d2b87bbab60af54fd480e6ff5fc62ceb23729666b7496188613e11eea6918c293cc45ec1b8568e2d
SSDEEP 3072:jpnhog0xjg8U2bY5Pz3c4f87EZ3jyIgZrwfI+V9M2eS+bjB6o2ME:jphojNU26PDc4fwVzH2e1nB6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-24480.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
Size 468KB
SHA256 09b2344ab5ad05a1c95552a980a52bd2afd8cc3cf1d0e08c58be1a250a4d74fa
MD5 b80ac7d52b3648b7c3a6b4e6404f4cbb
SHA1 9b756030996fe1fa87de8831eecab2499a393fa3
SHA512 5f4178e72ecf5f7e95f916844c7b86320f90d55728735fed6c838b3970a3ccf875ab46fcfe9d473b02ba8486c3e444ad39796423826ba7089e4d9a13ea6c408a
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUe0+bEB6o2ME:aphojNU26PDc4fEVzHUeDQB6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-24702.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
Size 468KB
SHA256 33cf6b4ad4d644d4955250b287397e43a42f2970de5625f240c28960a9ef6225
MD5 0228b001b7bf09f3ded0b2a55bd606f6
SHA1 59b14cd60db790e3cd01861d576d3fd13d14daf2
SHA512 e67d54dc1199d62f14691368dee4bc5aa4a4ea4fb548859a443575fd035b22749da80b84d505bfd20c571442e4454c69fb11194792a01e64c378c18e4d2e80ce
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZlwfI+V9M2eS+bEB6o2ME:aphojNU26PDc4fEVpH2e1QB6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27394.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
Size 468KB
SHA256 31f337f408200133955ffbc9c38c1ed6c70a44d05c6ff5ac303aca398a930ab7
MD5 22ac78fc7a7d8ed29ab75fb977eb5ae5
SHA1 057dfc63cbf598860676a354a1917de5c931da2d
SHA512 00412ffd6043043a613b2499e2f0c8daeb3d9ecbd278a8662871539b5ab6953bd9769c1b09de8b21dda7c3738efb0723f8b87cb6927728a085351b69ce034eff
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9M2e0+bEB6B2ME:aphojNU26PDc4fEVzH2eDQB6B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29938.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe
Size 468KB
SHA256 1fcf79aa6cf4ab80cf645b3dfa2614753e49cec13252dc92cbea1127ba7f1f71
MD5 0a874b68c5c9b3396d8ce32533d0d362
SHA1 08c344f8ebef7a1d174c358bf336e966aaaf1721
SHA512 15d9992785d5375c865a65fa6447890cabe3c53a1035542a7e480aaa5e28c5195f07db3ea6df0ea58d7808dbda0a768df0bad8caf293d779593c38a9db0456f3
SSDEEP 3072:aKnhog0xjg8U2bY5Pz3c4f8/EZ3fyIgZrwfI+V9YUO0+bEj6o2ME:aKhojNU26PDc4fwVzbUODQj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-30247.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30247.exe
Size 468KB
SHA256 ff0bfa3baf8e585f150ae3660b9e0ffc8f6c75fb939620f6c2d57a5800a8541e
MD5 20522e2f92f60ec35ba9e9542b06e543
SHA1 7f9ca9e80fe848ebfd9c027d7e7f3e2d3498c63c
SHA512 c54ea165029fef9da47af4ffa3d1979584296f39f7a46592aa60fa17b2bc1b5c82a590a16dba53da6e9907d9f95189b952680803c3e4f2b3a0baacf4513eeaf3
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgurwfI+V9MUO0+bEH6o2ME:aphojNU26PDc4fEVoHUODQH6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31478.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
Size 468KB
SHA256 bd12495b7634055751f3863f7c1c4f374e0efa28e7ad7f2b74d4e30dfc2fed11
MD5 0a7db88e6dcef986907c9a2c65180739
SHA1 0ef234c0e7ef65c1c0af0aba2479761f901127f4
SHA512 ed046131b190f2d9a8207462b40a337d3e907306805804803dac4b58c90a8b097696c25eaeba09cc99bf84b178deed5933bf1e996982d46feb55754ef53538f6
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUO0+lEH6o2cE:aphojNU26PDc4fEVzHUODWH6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32107.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
Size 468KB
SHA256 f607031ab845f61eda1e9240ed63a3d81588797d19a0ce4561f0d0a1c3161c31
MD5 b03664c8084ea58f0b22c363c5d3efda
SHA1 4def331a834a8b0b8ed8f6355c0c5bb3e4a3998e
SHA512 de118898d673e02777fd1b0d825a7dfe463ced97f7ee7f7d46e654bb95ff5acca943d712ada9b5e3bee0df5ec7a36abcfa36480cadc2455601c8819befdca749
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUE0+bEj6o2ME:aphojNU26PDc4fEVzHUEDQj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32439.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32439.exe
Size 468KB
SHA256 4e5d39412c8611cb0d81c74500b889a68c96554072de778e7ed6339f00aa10c1
MD5 0925271ac49b17cd7191b376d4b6885e
SHA1 18ec2f333d9230bfb297208956e2f15991637f9b
SHA512 904f2bd42be6903547d7453ec4c0f19e2bfb20a1514bebdb6d406408ee4381a82d9a460f2c411ee15346af385f3ee47281302352f2ccbc43ea762e0cbba75a59
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUe0+b2j6o2ME:aphojNU26PDc4fEVzHUeDqj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32870.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
Size 468KB
SHA256 89ea7b438e6cf831675c4419e8ea8f05ef813ed0d5bbd09baf703b73c597dafb
MD5 16f2800214a303a280a3aa0bad2abb73
SHA1 2c0a84cb0ab4345fddc3ffd636e54728d8096cfd
SHA512 e7de679d8a3c057b31d273f891696b9c276c339ec9a62736aa85b047439012ebcc229c1420cde01dbd3af22c6b96ea7e17967e2771eed9d00a45c584dc9d9565
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9SUO0+gEH6o2ME:aphojNU26PDc4fEVzxUODRH6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-34432.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
Size 468KB
SHA256 93220dff69af967fa2c171603901e8ce2e1be5a69fce85119050c423b4a76437
MD5 6bc9bbc9331bc7365945c817e5e4c7e3
SHA1 fbb459efd03807b2281e0b3f3ecdea75584d2560
SHA512 cfe0c3afecf5f372bae66f3dcfcb43b3fcc55e9c06ef14b264bafaa92cd8aa1ea6baf316b6cc30429cbe5fdd86a2ffe30da0d5b5f2239ae4d118d728a08998ff
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3fyIgZrwfI+V9M+O0+bZj6o2ME:aphojNU26PDc4fwVzH+ODVj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-34741.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
Size 468KB
SHA256 2db3798bc4b722132ed85cf9c308855cd30a181103983935eedde9ad563a5da0
MD5 82bc7600b2e2cbea4aaf3a73617e8d76
SHA1 4d6b80a7bb505d0a5ce65d5041b4a721c77c9aa2
SHA512 44e541221617ee4297bab98c511c069b23bdaa0e6422feeb734aeb27c475d67aa16e9cc5e8f2d7d88b58d49d5242f4d75511f208bc91d075cab218922ef5f406
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9TUO0+bEj6o2ME:aphojNU26PDc4fEVzoUODQj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-35960.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35960.exe
Size 468KB
SHA256 ccad70fcbcd84206b3ece7c6add3a47d57f4f068121d4b3d9f17a3777920285e
MD5 0a2244656b064f0e4d8e03a2d68ecc29
SHA1 7db5445277e38ea1f0b12fb7476dfe1f323526d2
SHA512 bfdcf673a295344c44dfcb7a717496c0c74dbad3fac3e315f298693df9aeee647bc04eb59f0cc12026440c67370bdaf7cb4ef51f3b4e76d42c16c11c89096a92
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9M2e0+bEB6o2ME:aphojNU26PDc4fEVzH2eDQB6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-37164.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
Size 468KB
SHA256 77478de23eccb90aedff8b5b6b16aa0f92efebcde71f43386d7603bc233f93a7
MD5 32a2723f4c63bb2a952e4ce82f8e54a9
SHA1 49fe78a9c6334522cf2d729e3207aca94ddf36eb
SHA512 ddbfa3e49da448d2c18dca38ed7bbb0ae0a747e607c06512b50ed8a2aaae541e521505fa2b57526ac126e6643e2d786a8bd74a77cb1cd49227ddf0eb615a8f5b
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUO0+bEj6o2ME:aphojNU26PDc4fEVzHUODQj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40872.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
Size 468KB
SHA256 2f811aeb5feeedffbeebe649b65b01076ac89d2f756f24599eee3fd19decd818
MD5 5c6b0b674a196c84289261853c97a50e
SHA1 bc7c9f4ba8397158f217ddbd7adf368618ab7e05
SHA512 c92b4318e442cc79f45e21ffdc5cb7b22c38abb1159a68c1fb247d4be478d0c316aa814b33c1443a3295c2c3b9f67c4e0b6a1db0f5bb34986b2fb97cd54cfa90
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9M2eS+bEB6o2ME:aphojNU26PDc4fEVzH2e1QB6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41208.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
Size 468KB
SHA256 2b53d70cb7e5c56ecf1e262b09d8ec23b0986e89c1740aa7e990c77bb7080c7c
MD5 2718e082f9e72eaaddd6feb17150c43a
SHA1 427c41defe3a28fced59250f834b4ec81ee13464
SHA512 db62263898e28e6a2dfb2d213f4ed6ec5834f216f04b361f6068202651a410b4f460e61709550105770474c141629968bf749e5691bd8a1f37d5dcd7b220c51e
SSDEEP 3072:aKnhog0xjg8U2bY5Pz3c4f8/EZ3fyIgZrwfI+V9MUO0+bEj6o2ME:aKhojNU26PDc4fwVzHUODQj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-44128.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
Size 468KB
SHA256 8e123500a092bf2dc7308cdbc0822a65b794252d3be79bd6e2391226cd93545e
MD5 7be485613317fc804937e997d5f70d77
SHA1 68d5d63a9aea5dfae0d1e7a0550be56cec53e0c6
SHA512 1fc2f1b53730b0ff9bf5e51c1a2cba84942e0e8aed0755b00079af09936367dcd7818ad6b12450c1330942dbeab9bccf124d3725888fe76451d54d41a95c782c
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUO0+lEH6o2ME:aphojNU26PDc4fEVzHUODWH6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49232.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
Size 468KB
SHA256 9ed4a6205c48150ef0b78d5db21b03ea13c1cd50f6e596da6e95d747144e6d46
MD5 6c8004fac4ebfafb178b78bf3a20e5f8
SHA1 8c5e0af79a54c7b826068aed41d4c4bb82cccb3d
SHA512 b1894508f111375ab2f1296be157d2bb80177d188315758fe2f17b1b6d6830f3a2f8d9cac8a2a22fecf1238f557661ac530533e85415a49563af8c41bc95a2a9
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3fyIgZrwfI+V9MUO0+bZj6o2ME:aphojNU26PDc4fwVzHUODVj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-50337.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
Size 468KB
SHA256 5bd3023df82dbca1863ff53370bf6b7a65f5a3ba5ee7f057e3f743052db34b60
MD5 057ffbcba7decb36ef6a5dd189b96d92
SHA1 704087a17c799b46190b4637654a9d4fbcd9f6e2
SHA512 d80dd5f6ee19bd9643a31f2aca2d366dfc4e3d6176959ae76618330e8634966de363e2906d10ce55134ad31ec08c93b384a8b44ab8ce44fca210d24eae146d26
SSDEEP 3072:apnhog0xjg8U2bY5PzNc4f8/EZ3fyIgZrwfI+V9MUO0+bZj6o2ME:aphojNU26Pxc4fwVzHUODVj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52449.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52449.exe
Size 468KB
SHA256 2530e55dba570bacdfa4cde60ac32e9ba90d714af9936172c0910af637421f12
MD5 42b6fb974a4f4f0a49bb5f861353d63d
SHA1 394530b8f3b4ec969172d3d6133c269fb9ba12df
SHA512 c8a2a9fefe3db3f2f8342c2352c19f661e93e7a569b9d25c2d144a0097faa85545ace9e9a948c03f2aed97f7a923c30a555c3d4005c9aafb8f13186ee2af4c61
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUO0+bEj6o2ME:aphojNU26PDc4fEVzHUODQj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52514.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
Size 468KB
SHA256 75bb8370f46b9c06634795aed36606b1f8a601744e8e684d9f0b158cb29decfc
MD5 3493e5c9120d83e7cb07b35e77e3dc4c
SHA1 041e4a9a7ded8ffdb7f3738594a715ea3ad83f45
SHA512 b46630d40933300072713c4a812b52f26c3f6264cbc18a669fce145418f07ad0b91c7ee20044679e3d705151578852217ccbcec96e3ac36ebbda0554f12c150e
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUO0+bEH6o2ME:aphojNU26PDc4fEVzHUODQH6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54989.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
Size 468KB
SHA256 c4aa003c4820d6e87ed5240822c14d61d9d23001d8fafbe7eb769cf94655dfb5
MD5 993942deb8a87e71e409eba08bd456ef
SHA1 9cd8e006d9eb04a5356d9940193e51580a8e4ed4
SHA512 1e0ddbb6ea9154acd0bb0c47cac636c6023429b56f2288800a0e62905daf0fd751094918c7a16365c33a50d08e4408107b858a1baed186d839eda4e59799d6b9
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3fyIgZrwfI+V9MUO0+bEj6o2ME:aphojNU26PDc4fwVzHUODQj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56990.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
Size 468KB
SHA256 5c73b2e0e0a1aa64e111d3b0df257f405e921b47a54fb0bc9e32e3e3cee127a2
MD5 56d0be911fcb0be891ff4d902850a06b
SHA1 2a3bfd975516d26e87f300d8c934dc1a32cd04d3
SHA512 3249e2918d754d1da0d5d6b85ddaf87e6a750f7fd483dcb84ecbabe642a7338319b91986733cbfd2521003355469147c272a9dfea3f7339beca60a4bda2fc079
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUO0+gEH6J2ME:aphojNU26PDc4fEVzHUODRH6J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63596.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
Size 468KB
SHA256 6bf5efcdeed992ef2a46ba8c44f370f2abacce5109cde0d4dfd6e63d67e7a8df
MD5 fa32e53a4beb35f304171974a978968e
SHA1 24bc2bf4af092eedea2b9a88aac293bed321c8c1
SHA512 a5fbba81ae4fa592e4846976f7cfd0241a44383529308745e12d1c2e7dff8a9f58498bb14526d3cf63510afc624292ee1539583f48f09d18d39664f16cbe8a67
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9M2eS+bEB6o2My:aphojNU26PDc4fEVzH2e1QB6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-64640.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe
Size 468KB
SHA256 58ba14c76e9bc897aa420308cbf87f9e15a8d656d483496ffe4808464bbb7422
MD5 22765aa2c2d348d8164da3aef47523ce
SHA1 8db6f828c8a2a1a9c00e9fde688314313e7e9287
SHA512 c4460a16647df59493d340559a2d3ae3076518321a611205af5f32a6bf8f094732742b4f9aa4f198517baf1f7b16185f6714428f5dd35909597ac3bd1f9eb8dc
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUe0+bEj6n2ME:aphojNU26PDc4fEVzHUeDQj6n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-64966.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64966.exe
Size 468KB
SHA256 53c27f87ee7b10933aa513773a403a7846748b8990512f8000306ff4fe4530be
MD5 e72c08426959281fef403f1b37b0bff0
SHA1 c6d080432c8f38059678a70a59aadf6aeebad98c
SHA512 f85b6c7ce07667f19e36c4ff627736771577a216e5a9f14bdbb3b405864bfb56e063910cf4e22da397552a6e46d23377387d1bbf245431b8dfed5c98dedfc981
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9TUO0+bEj6o2MJ:aphojNU26PDc4fEVzoUODQj6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-8920.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8920.exe
Size 468KB
SHA256 0d17ccaeae22f486232f4e4f21aee1f398430a4edad13bf8bcde48fcdfa799cd
MD5 083f552708ddae162b47b9bcf7be1d73
SHA1 8b7651f3216fa004ac38014e934fdbb5c50dfc3d
SHA512 8899330fe793a92646a24d0ca7f1f93aa49e4bbbe23bae1003d83d4bbc127a739637c7b6200d1374e0326324ca22c9bb15f46a38a6609903ac84fc34899194d2
SSDEEP 3072:apnhog0xjg8U2bY5Pz3c4f8/EZ3jyIgZrwfI+V9MUeJ+bEj6n2ME:aphojNU26PDc4fEVzHUesQj6n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-9912.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9912.exe
Size 468KB
SHA256 888c6752841bc88560e94c1a38bde5d472d5940d3fb972f738763df90c3b1122
MD5 224b43ae1fb9c649f5c808536791fff7
SHA1 038fea4efb5b00289cbb24e8006d9138d2b7af1d
SHA512 4fd0ff5a8d57cdf317eeaf66506d4a5ad203dbdfa938b5c8041863260d60b3b900fe3490db7e71b48506f5825c109d3ba444c8af7286300cb1f608cf6aabba6e
SSDEEP 3072:ppnhog0xjg8U2bY5Pz3c4f8/EZ3jpIgZrwfI+V9MUO0+gEH6J2ML:pphojNU26PDc4fTVzHUODRH6J
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-177-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/216-162-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/388-43-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/440-368-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/740-65-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/776-347-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1052-21-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1060-281-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1204-240-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1212-415-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1244-317-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1264-241-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1344-39-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1372-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1384-123-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1492-304-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1548-55-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1688-414-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1704-299-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1716-371-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1724-259-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1764-288-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1800-77-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1812-413-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1844-388-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1900-223-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1936-258-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1944-182-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1972-316-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2024-320-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2144-408-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2160-6-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2216-416-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2272-344-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2284-66-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2440-383-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2632-412-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2716-384-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2748-179-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2760-274-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2764-330-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2860-180-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2932-222-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3000-129-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3004-114-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3288-205-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3324-404-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3356-391-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3460-111-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3476-257-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3544-417-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3592-13-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3612-83-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3644-232-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3660-295-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3712-390-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3836-181-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3864-389-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3928-198-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4000-149-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4020-248-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4160-27-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4300-82-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4308-101-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4444-140-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4480-402-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4668-212-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4696-40-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4748-387-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4816-233-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4832-365-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4908-178-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5012-341-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5064-403-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5104-282-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5128-418-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5224-441-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5304-445-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5320-442-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5380-455-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5400-462-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5412-463-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5456-476-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5476-477-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5548-490-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5556-481-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5584-485-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5604-486-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5692-511-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5728-514-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5752-512-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5828-522-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5840-523-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5852-535-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5896-524-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5984-528-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads