c747caa3e08ec6e3a40783a120556d478fd003988a082212ee5cd0c7f174527c

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51d0dc05ab2906476cd80305a6a96880N.exe
Size

468KB
MD5

51d0dc05ab2906476cd80305a6a96880
SHA1

03f32325b889ed5ab55911fc7f139bad8a820704
SHA256

c747caa3e08ec6e3a40783a120556d478fd003988a082212ee5cd0c7f174527c
SHA512

1695cfb27de0c659a741489fc09cb9d537c9f3c8ca24d191c222e226e8f0dfb0664a9edb787b1d7b257bacf10629730cdaa5ac8e7926ec54b92cf73e1b590ba0
SSDEEP

3072:SqGtogUxjv8U2bY9PzsyqfU/EAhjj+plPFHXaVIRdQCGpdBNQQlU:Sq0ofUU2+PoyqfYu7VdQdDBNQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
380	Unicorn-63634.exe
3444	Unicorn-10380.exe
4056	Unicorn-56929.exe
4776	Unicorn-5004.exe
2952	Unicorn-63250.exe
3784	Unicorn-43384.exe
4612	Unicorn-57120.exe
448	Unicorn-64890.exe
3540	Unicorn-65082.exe
1716	Unicorn-58952.exe
4496	Unicorn-4568.exe
4340	Unicorn-65274.exe
3848	Unicorn-29072.exe
2684	Unicorn-48938.exe
4804	Unicorn-62788.exe
4516	Unicorn-50578.exe
704	Unicorn-39072.exe
2544	Unicorn-47802.exe
4080	Unicorn-27251.exe
3832	Unicorn-47117.exe
4596	Unicorn-38757.exe
3932	Unicorn-38757.exe
2916	Unicorn-39826.exe
3412	Unicorn-23682.exe
2692	Unicorn-39945.exe
1764	Unicorn-31279.exe
4968	Unicorn-34079.exe
2948	Unicorn-20344.exe
3768	Unicorn-25986.exe
1888	Unicorn-25986.exe
1168	Unicorn-3711.exe
2720	Unicorn-55513.exe
4548	Unicorn-31859.exe
2308	Unicorn-21007.exe
4796	Unicorn-26873.exe
2632	Unicorn-26858.exe
3252	Unicorn-42509.exe
5024	Unicorn-43386.exe
4152	Unicorn-19074.exe
512	Unicorn-33770.exe
4560	Unicorn-19074.exe
2524	Unicorn-22835.exe
4020	Unicorn-19266.exe
2516	Unicorn-13135.exe
1464	Unicorn-14667.exe
1944	Unicorn-9067.exe
2088	Unicorn-43770.exe
4992	Unicorn-43770.exe
4268	Unicorn-9753.exe
4352	Unicorn-21683.exe
3112	Unicorn-22560.exe
1096	Unicorn-42426.exe
5136	Unicorn-19959.exe
5144	Unicorn-25825.exe
5180	Unicorn-21875.exe
5188	Unicorn-21875.exe
5472	Unicorn-3697.exe
5488	Unicorn-1896.exe
5508	Unicorn-45389.exe
5532	Unicorn-37029.exe
5548	Unicorn-21954.exe
5564	Unicorn-17355.exe
5584	Unicorn-30122.exe
5600	Unicorn-13712.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
16352	15692	WerFault.exe	737
16360	12624	WerFault.exe	716

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22795.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	9600	dwm.exe
Token: SeChangeNotifyPrivilege	9600	dwm.exe
Token: 33	9600	dwm.exe
Token: SeIncBasePriorityPrivilege	9600	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2888	51d0dc05ab2906476cd80305a6a96880N.exe
380	Unicorn-63634.exe
3444	Unicorn-10380.exe
4056	Unicorn-56929.exe
3784	Unicorn-43384.exe
4776	Unicorn-5004.exe
2952	Unicorn-63250.exe
4612	Unicorn-57120.exe
448	Unicorn-64890.exe
3540	Unicorn-65082.exe
1716	Unicorn-58952.exe
2684	Unicorn-48938.exe
3848	Unicorn-29072.exe
4340	Unicorn-65274.exe
4496	Unicorn-4568.exe
4804	Unicorn-62788.exe
4516	Unicorn-50578.exe
704	Unicorn-39072.exe
2544	Unicorn-47802.exe
4080	Unicorn-27251.exe
3832	Unicorn-47117.exe
4596	Unicorn-38757.exe
2916	Unicorn-39826.exe
1764	Unicorn-31279.exe
2692	Unicorn-39945.exe
2948	Unicorn-20344.exe
3412	Unicorn-23682.exe
4968	Unicorn-34079.exe
3932	Unicorn-38757.exe
3768	Unicorn-25986.exe
1888	Unicorn-25986.exe
2720	Unicorn-55513.exe
1168	Unicorn-3711.exe
4548	Unicorn-31859.exe
4796	Unicorn-26873.exe
2308	Unicorn-21007.exe
2632	Unicorn-26858.exe
3252	Unicorn-42509.exe
5024	Unicorn-43386.exe
4152	Unicorn-19074.exe
512	Unicorn-33770.exe
2524	Unicorn-22835.exe
4560	Unicorn-19074.exe
4020	Unicorn-19266.exe
1944	Unicorn-9067.exe
4268	Unicorn-9753.exe
1096	Unicorn-42426.exe
2516	Unicorn-13135.exe
1464	Unicorn-14667.exe
2088	Unicorn-43770.exe
4352	Unicorn-21683.exe
3112	Unicorn-22560.exe
4992	Unicorn-43770.exe
5136	Unicorn-19959.exe
5188	Unicorn-21875.exe
5180	Unicorn-21875.exe
5144	Unicorn-25825.exe
5472	Unicorn-3697.exe
5488	Unicorn-1896.exe
5652	Unicorn-37413.exe
5668	Unicorn-29551.exe
5620	Unicorn-65216.exe
5584	Unicorn-30122.exe
5628	Unicorn-5809.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 380	2888	51d0dc05ab2906476cd80305a6a96880N.exe	95
PID 2888 wrote to memory of 380	2888	51d0dc05ab2906476cd80305a6a96880N.exe	95
PID 2888 wrote to memory of 380	2888	51d0dc05ab2906476cd80305a6a96880N.exe	95
PID 380 wrote to memory of 3444	380	Unicorn-63634.exe	101
PID 380 wrote to memory of 3444	380	Unicorn-63634.exe	101
PID 380 wrote to memory of 3444	380	Unicorn-63634.exe	101
PID 2888 wrote to memory of 4056	2888	51d0dc05ab2906476cd80305a6a96880N.exe	102
PID 2888 wrote to memory of 4056	2888	51d0dc05ab2906476cd80305a6a96880N.exe	102
PID 2888 wrote to memory of 4056	2888	51d0dc05ab2906476cd80305a6a96880N.exe	102
PID 4056 wrote to memory of 4776	4056	Unicorn-56929.exe	104
PID 4056 wrote to memory of 4776	4056	Unicorn-56929.exe	104
PID 4056 wrote to memory of 4776	4056	Unicorn-56929.exe	104
PID 3444 wrote to memory of 2952	3444	Unicorn-10380.exe	105
PID 3444 wrote to memory of 2952	3444	Unicorn-10380.exe	105
PID 3444 wrote to memory of 2952	3444	Unicorn-10380.exe	105
PID 380 wrote to memory of 3784	380	Unicorn-63634.exe	106
PID 380 wrote to memory of 3784	380	Unicorn-63634.exe	106
PID 380 wrote to memory of 3784	380	Unicorn-63634.exe	106
PID 2888 wrote to memory of 4612	2888	51d0dc05ab2906476cd80305a6a96880N.exe	107
PID 2888 wrote to memory of 4612	2888	51d0dc05ab2906476cd80305a6a96880N.exe	107
PID 2888 wrote to memory of 4612	2888	51d0dc05ab2906476cd80305a6a96880N.exe	107
PID 3784 wrote to memory of 448	3784	Unicorn-43384.exe	110
PID 3784 wrote to memory of 448	3784	Unicorn-43384.exe	110
PID 3784 wrote to memory of 448	3784	Unicorn-43384.exe	110
PID 2952 wrote to memory of 3540	2952	Unicorn-63250.exe	111
PID 2952 wrote to memory of 3540	2952	Unicorn-63250.exe	111
PID 2952 wrote to memory of 3540	2952	Unicorn-63250.exe	111
PID 380 wrote to memory of 1716	380	Unicorn-63634.exe	112
PID 380 wrote to memory of 1716	380	Unicorn-63634.exe	112
PID 380 wrote to memory of 1716	380	Unicorn-63634.exe	112
PID 3444 wrote to memory of 4496	3444	Unicorn-10380.exe	113
PID 3444 wrote to memory of 4496	3444	Unicorn-10380.exe	113
PID 3444 wrote to memory of 4496	3444	Unicorn-10380.exe	113
PID 4776 wrote to memory of 4340	4776	Unicorn-5004.exe	114
PID 4776 wrote to memory of 4340	4776	Unicorn-5004.exe	114
PID 4776 wrote to memory of 4340	4776	Unicorn-5004.exe	114
PID 4056 wrote to memory of 3848	4056	Unicorn-56929.exe	115
PID 4056 wrote to memory of 3848	4056	Unicorn-56929.exe	115
PID 4056 wrote to memory of 3848	4056	Unicorn-56929.exe	115
PID 4612 wrote to memory of 2684	4612	Unicorn-57120.exe	116
PID 4612 wrote to memory of 2684	4612	Unicorn-57120.exe	116
PID 4612 wrote to memory of 2684	4612	Unicorn-57120.exe	116
PID 2888 wrote to memory of 4804	2888	51d0dc05ab2906476cd80305a6a96880N.exe	117
PID 2888 wrote to memory of 4804	2888	51d0dc05ab2906476cd80305a6a96880N.exe	117
PID 2888 wrote to memory of 4804	2888	51d0dc05ab2906476cd80305a6a96880N.exe	117
PID 448 wrote to memory of 4516	448	Unicorn-64890.exe	118
PID 448 wrote to memory of 4516	448	Unicorn-64890.exe	118
PID 448 wrote to memory of 4516	448	Unicorn-64890.exe	118
PID 3784 wrote to memory of 704	3784	Unicorn-43384.exe	119
PID 3784 wrote to memory of 704	3784	Unicorn-43384.exe	119
PID 3784 wrote to memory of 704	3784	Unicorn-43384.exe	119
PID 3540 wrote to memory of 2544	3540	Unicorn-65082.exe	120
PID 3540 wrote to memory of 2544	3540	Unicorn-65082.exe	120
PID 3540 wrote to memory of 2544	3540	Unicorn-65082.exe	120
PID 2952 wrote to memory of 4080	2952	Unicorn-63250.exe	121
PID 2952 wrote to memory of 4080	2952	Unicorn-63250.exe	121
PID 2952 wrote to memory of 4080	2952	Unicorn-63250.exe	121
PID 4496 wrote to memory of 3832	4496	Unicorn-4568.exe	122
PID 4496 wrote to memory of 3832	4496	Unicorn-4568.exe	122
PID 4496 wrote to memory of 3832	4496	Unicorn-4568.exe	122
PID 3848 wrote to memory of 4596	3848	Unicorn-29072.exe	123
PID 3848 wrote to memory of 4596	3848	Unicorn-29072.exe	123
PID 3848 wrote to memory of 4596	3848	Unicorn-29072.exe	123
PID 2684 wrote to memory of 3932	2684	Unicorn-48938.exe	124

C:\Users\Admin\AppData\Local\Temp\51d0dc05ab2906476cd80305a6a96880N.exe
"C:\Users\Admin\AppData\Local\Temp\51d0dc05ab2906476cd80305a6a96880N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63250.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32434.exe
        8⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15537.exe
        9⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65138.exe
        10⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        10⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36224.exe
        10⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36995.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        9⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        9⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe
        8⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7577.exe
        9⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        9⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        9⤵
        
        PID:17848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35953.exe
        8⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7711.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        8⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27664.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
        8⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        9⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14682.exe
        9⤵
        
        PID:17864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9936.exe
        8⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        8⤵
        
        PID:16896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
        8⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        8⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        7⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
        7⤵
        
        PID:18136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22560.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        7⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        8⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33048.exe
        9⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        8⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        8⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        8⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8848.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        7⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        7⤵
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        7⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57736.exe
        6⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        7⤵
        
        PID:14896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15576.exe
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        6⤵
        
        PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42509.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43586.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
        9⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        9⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
        9⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe
        9⤵
        
        PID:17948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        8⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
        8⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
        8⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14378.exe
        8⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        7⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
        8⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23746.exe
        9⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61876.exe
        9⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        8⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        8⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56947.exe
        8⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22879.exe
        7⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe
        8⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
        8⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        7⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26488.exe
        7⤵
        
        PID:17244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26792.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        8⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        8⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        8⤵
        
        PID:18188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20895.exe
        7⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
        6⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe
        7⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8587.exe
        7⤵
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        7⤵
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26436.exe
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        6⤵
        
        PID:16972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58194.exe
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
        8⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
        8⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
        8⤵
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13643.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26346.exe
        7⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        7⤵
        
        PID:16796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37939.exe
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        7⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        7⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
        7⤵
        
        PID:18240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23642.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47492.exe
        6⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41187.exe
        6⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        5⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28714.exe
        6⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        7⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        6⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29207.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54969.exe
        5⤵
        
        PID:10928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60642.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47117.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42426.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        8⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
        9⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        9⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6731.exe
        8⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        8⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24779.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe
        8⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59049.exe
        8⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57827.exe
        8⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11743.exe
        7⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25500.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        7⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        6⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        7⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16179.exe
        7⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
        7⤵
        
        PID:17212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        6⤵
        
        PID:14580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        6⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21875.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        6⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41386.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
        8⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        8⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56947.exe
        8⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5584.exe
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44529.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        7⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13840.exe
        6⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        7⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        7⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        7⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
        5⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1521.exe
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18330.exe
        6⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28636.exe
        5⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe
        6⤵
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16520.exe
        6⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5967.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        5⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42293.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30122.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        7⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        7⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
        7⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9035.exe
        6⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18779.exe
        6⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51000.exe
        6⤵
        
        PID:332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
        6⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
        6⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe
        5⤵
        
        PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        5⤵
        
        PID:12812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26495.exe
        5⤵
        
        PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        6⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50857.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        6⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        5⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe
        6⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
        5⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13112.exe
        5⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        5⤵
        
        PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41856.exe
      4⤵
      PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        5⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55245.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22795.exe
        5⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30023.exe
        5⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35353.exe
        5⤵
        
        PID:17444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16089.exe
      4⤵
      PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49261.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65408.exe
      4⤵
      PID:12168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
      4⤵
      PID:16888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43384.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50578.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        7⤵
        Executes dropped EXE
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37925.exe
        9⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28162.exe
        10⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42520.exe
        10⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        9⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
        9⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50812.exe
        9⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33647.exe
        8⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35808.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
        8⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38664.exe
        8⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
        8⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44794.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55716.exe
        8⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        7⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-915.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        6⤵
        Executes dropped EXE
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        9⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        9⤵
        
        PID:18012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24907.exe
        8⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        8⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        8⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        7⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57626.exe
        8⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23375.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13112.exe
        7⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49272.exe
        7⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
        6⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        7⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        7⤵
        
        PID:16996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exe
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32111.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22155.exe
        6⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55513.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        6⤵
        Executes dropped EXE
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        7⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe
        8⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
        8⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5432.exe
        8⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
        8⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        7⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42677.exe
        7⤵
        
        PID:16788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16706.exe
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17035.exe
        7⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26116.exe
        7⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
        6⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
        7⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39187.exe
        7⤵
        
        PID:17832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        6⤵
        
        PID:16848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59171.exe
        8⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        7⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59499.exe
        7⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35161.exe
        7⤵
        
        PID:16724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        6⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38930.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe
        7⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34464.exe
        6⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
        5⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe
        6⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        7⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        7⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5875.exe
        6⤵
        
        PID:11016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20895.exe
        6⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        6⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20743.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59122.exe
        6⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        6⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19115.exe
        5⤵
        
        PID:11612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        5⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        5⤵
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36882.exe
        8⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        8⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15530.exe
        8⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42755.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        7⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24267.exe
        7⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32938.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
        8⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        8⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        7⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
        6⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
        7⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
        7⤵
        
        PID:15516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        6⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22347.exe
        6⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61837.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        7⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18251.exe
        6⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50418.exe
        7⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6855.exe
        6⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        6⤵
        
        PID:18080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        6⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38930.exe
        7⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exe
        7⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56371.exe
        6⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36529.exe
        5⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
        6⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        6⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        5⤵
        
        PID:16912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21954.exe
        5⤵
        Executes dropped EXE
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3953.exe
        8⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36987.exe
        8⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        7⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        7⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        6⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38451.exe
        6⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13112.exe
        6⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10538.exe
        6⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36107.exe
        5⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28714.exe
        6⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48826.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        7⤵
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22795.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        6⤵
        
        PID:18000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
        5⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20005.exe
        6⤵
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        6⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        5⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34717.exe
        5⤵
        
        PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13712.exe
      4⤵
      Executes dropped EXE
      PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22834.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56371.exe
        6⤵
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        5⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43117.exe
        6⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23671.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        5⤵
        
        PID:15656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        5⤵
        
        PID:17964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47448.exe
      4⤵
      PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        5⤵
        
        PID:10032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23584.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
        5⤵
        
        PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31395.exe
      4⤵
      PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7369.exe
      4⤵
      PID:12740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
      4⤵
      PID:15528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58952.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37413.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50021.exe
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25933.exe
        8⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe
        8⤵
        
        PID:16876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9639.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11882.exe
        7⤵
        
        PID:17872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        7⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        7⤵
        
        PID:15120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57705.exe
        6⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        6⤵
        
        PID:17792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        6⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        7⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54376.exe
        7⤵
        
        PID:17420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
        6⤵
        
        PID:18252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        5⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe
        6⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53883.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        5⤵
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2823.exe
        5⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22347.exe
        5⤵
        
        PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40712.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19792.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        6⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        7⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20250.exe
        7⤵
        
        PID:17992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33952.exe
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        6⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36386.exe
        6⤵
        
        PID:17784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        5⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34717.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57052.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe
        5⤵
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        5⤵
        
        PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
      4⤵
      PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14681.exe
      4⤵
      PID:13708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5495.exe
      4⤵
      PID:16712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43386.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
        5⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59154.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        7⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        7⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        7⤵
        
        PID:16968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55553.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
        6⤵
        
        PID:12016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32857.exe
        6⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        5⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        6⤵
        
        PID:12932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
        6⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe
        5⤵
        
        PID:9244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3191.exe
        5⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        5⤵
        
        PID:17020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33419.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        5⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        5⤵
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60049.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
      4⤵
      PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
      4⤵
      PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2335.exe
      4⤵
      PID:12804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34717.exe
      4⤵
      PID:16448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
      4⤵
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48677.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17578.exe
        6⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
        7⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        6⤵
        
        PID:13580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45052.exe
        6⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        5⤵
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        5⤵
        
        PID:18096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
        5⤵
        
        PID:15072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
        5⤵
        
        PID:16244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11831.exe
      4⤵
      PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
      4⤵
      PID:13336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
      4⤵
      PID:16744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
    3⤵
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
      4⤵
      PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14347.exe
        5⤵
        
        PID:13144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exe
        5⤵
        
        PID:17924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
      4⤵
      PID:11740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62121.exe
      4⤵
      PID:15388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
      4⤵
      PID:400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
    3⤵
    PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
      4⤵
      PID:9304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
      4⤵
      PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
      4⤵
      PID:18232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
    3⤵
    PID:11112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
    3⤵
    PID:16756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56929.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56929.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9753.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        8⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43429.exe
        9⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8587.exe
        9⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        9⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54609.exe
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27057.exe
        8⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        8⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        7⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3953.exe
        8⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        8⤵
        
        PID:17428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe
        7⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46160.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
        7⤵
        
        PID:18176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35257.exe
        6⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
        7⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54041.exe
        7⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
        7⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
        6⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21875.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65298.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40421.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
        8⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe
        8⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46784.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6643.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19634.exe
        7⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        7⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
        6⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
        7⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
        6⤵
        
        PID:16428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39480.exe
        5⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37733.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23807.exe
        6⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        5⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44109.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe
        6⤵
        
        PID:18060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
        5⤵
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        5⤵
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        5⤵
        
        PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
        6⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        8⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        8⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        8⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59281.exe
        7⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13840.exe
        6⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48052.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe
        6⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58291.exe
        6⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24783.exe
        5⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
        6⤵
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37455.exe
        6⤵
        
        PID:17912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56596.exe
        5⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39883.exe
        5⤵
        
        PID:13872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16658.exe
        5⤵
        
        PID:18320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
        6⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
        7⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        7⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59171.exe
        7⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        6⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58483.exe
        6⤵
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54489.exe
        5⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20634.exe
        6⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57705.exe
        5⤵
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        5⤵
        
        PID:13660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
      4⤵
      PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
        5⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25784.exe
        5⤵
        
        PID:11620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        5⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65036.exe
        5⤵
        
        PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
      4⤵
      PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
        5⤵
        
        PID:13288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
      4⤵
      PID:12272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
      4⤵
      PID:15472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
      4⤵
      PID:2040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29072.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26858.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47338.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        8⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25784.exe
        8⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        8⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        8⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29537.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11089.exe
        7⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45812.exe
        6⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        7⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53608.exe
        7⤵
        
        PID:16160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
        6⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40009.exe
        6⤵
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        6⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        5⤵
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24032.exe
        6⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39122.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37184.exe
        7⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
        6⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59540.exe
        6⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        5⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26381.exe
        6⤵
        
        PID:16680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
        5⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        5⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        5⤵
        
        PID:17952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22835.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        5⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65101.exe
        6⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        7⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29295.exe
        7⤵
        
        PID:17084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
        6⤵
        
        PID:13368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        6⤵
        
        PID:18072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
        5⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29487.exe
        6⤵
        
        PID:16632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50368.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50116.exe
        5⤵
        
        PID:16452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        5⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        6⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
        6⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        5⤵
        
        PID:13600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1611.exe
        5⤵
        
        PID:16664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
      4⤵
      PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        5⤵
        
        PID:15896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13338.exe
        5⤵
        
        PID:736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
      4⤵
      PID:11100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60849.exe
      4⤵
      PID:13660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
      4⤵
      PID:16840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34079.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
        6⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40141.exe
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
        7⤵
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
        6⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43408.exe
        6⤵
        
        PID:16592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21624.exe
        5⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11713.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53115.exe
        6⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54120.exe
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
        5⤵
        
        PID:14800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
      4⤵
      PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26026.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54041.exe
        5⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
      4⤵
      PID:8748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
      4⤵
      PID:11696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30389.exe
      4⤵
      PID:15944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
      4⤵
      PID:18156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
      4⤵
      PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51962.exe
        5⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51506.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54184.exe
        6⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48553.exe
        5⤵
        
        PID:10848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20895.exe
        5⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        5⤵
        
        PID:15780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
      4⤵
      PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12210.exe
      4⤵
      PID:10008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
      4⤵
      PID:3428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
    3⤵
    PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28714.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
      4⤵
      PID:10436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
      4⤵
      PID:15976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
      4⤵
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11328.exe
    3⤵
    PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
      4⤵
      PID:17856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12647.exe
    3⤵
    PID:13412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
    3⤵
    PID:6160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48938.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        7⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        7⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33647.exe
        6⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        6⤵
        
        PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52064.exe
        5⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        6⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        6⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58232.exe
        5⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe
        5⤵
        
        PID:13668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
        6⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        7⤵
        
        PID:15692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15692 -s 72
        8⤵
        Program crash
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe
        7⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65360.exe
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30389.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14753.exe
        6⤵
        
        PID:18200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        5⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42520.exe
        6⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        6⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15583.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27448.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48992.exe
      4⤵
      PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39482.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9936.exe
        5⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
        5⤵
        
        PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33144.exe
      4⤵
      PID:10052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
      4⤵
      PID:13616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45650.exe
      4⤵
      PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
        6⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20266.exe
        7⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        7⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
        7⤵
        
        PID:18308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6835.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54825.exe
        6⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25234.exe
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
        5⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38437.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30770.exe
        5⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        5⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
        5⤵
        
        PID:18292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61209.exe
      4⤵
      PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
        5⤵
        
        PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21130.exe
        5⤵
        
        PID:18416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50731.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe
      4⤵
      PID:12472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
      4⤵
      PID:6960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13904.exe
    3⤵
    PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29850.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-784.exe
        5⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47098.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exe
        6⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30770.exe
        5⤵
        
        PID:12244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        5⤵
        
        PID:18088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26419.exe
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
      4⤵
      PID:10460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
      4⤵
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
      4⤵
      PID:16812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
    3⤵
    PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
      4⤵
      PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
        5⤵
        
        PID:13248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe
        5⤵
        
        PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
      4⤵
      PID:10452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
      4⤵
      PID:11480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
      4⤵
      PID:11796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11328.exe
    3⤵
    PID:9012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28501.exe
    3⤵
    PID:12084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
    3⤵
    PID:16852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39826.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19074.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        5⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        6⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1433.exe
        7⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        7⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        7⤵
        
        PID:17892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45547.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26680.exe
        6⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        5⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11137.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        6⤵
        
        PID:18124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
        5⤵
        
        PID:11124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        5⤵
        
        PID:12536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        5⤵
        
        PID:17060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe
        5⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
        6⤵
        
        PID:13216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36883.exe
        6⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12210.exe
        5⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
        5⤵
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        5⤵
        
        PID:18044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        5⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        5⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23434.exe
        5⤵
        
        PID:16444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
      4⤵
      PID:11132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
      4⤵
      PID:14488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
      4⤵
      PID:16648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48589.exe
        5⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        6⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        6⤵
        
        PID:18148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46811.exe
        5⤵
        
        PID:11492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21856.exe
        5⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        5⤵
        
        PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34016.exe
      4⤵
      PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26810.exe
        5⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        5⤵
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46324.exe
        5⤵
        
        PID:18300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
      4⤵
      PID:11500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
      4⤵
      PID:15172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
      4⤵
      PID:15544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55537.exe
    3⤵
    PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34002.exe
      4⤵
      PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
      4⤵
      PID:16180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47931.exe
    3⤵
    PID:9144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
    3⤵
    PID:12748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
    3⤵
    PID:4440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31279.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31279.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19074.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43586.exe
      4⤵
      PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28714.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        6⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe
        6⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27378.exe
        5⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47985.exe
        5⤵
        
        PID:12768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe
        5⤵
        
        PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43424.exe
      4⤵
      PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        5⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4344.exe
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        5⤵
        
        PID:13464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9779.exe
        5⤵
        
        PID:16772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe
      4⤵
      PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53553.exe
      4⤵
      PID:11568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4255.exe
      4⤵
      PID:12624
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12624 -s 84
        5⤵
        Program crash
        
        PID:16360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
      4⤵
      PID:16660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17768.exe
    3⤵
    PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
      4⤵
      PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36026.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
        5⤵
        
        PID:13884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
      4⤵
      PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
      4⤵
      PID:12596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23575.exe
      4⤵
      PID:15372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
      4⤵
      PID:18020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28162.exe
      4⤵
      PID:11772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42520.exe
      4⤵
      PID:15540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
      4⤵
      PID:13628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59985.exe
    3⤵
    PID:10856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18095.exe
    3⤵
    PID:14836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
    3⤵
    PID:1564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61837.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43218.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18104.exe
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe
        5⤵
        
        PID:16824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54609.exe
      4⤵
      PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48508.exe
      4⤵
      PID:216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34016.exe
    3⤵
    PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12012.exe
      4⤵
      PID:11884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
      4⤵
      PID:6716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
    3⤵
    PID:11728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53456.exe
    3⤵
    PID:15440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
    3⤵
    PID:872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46722.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46722.exe
  2⤵
  PID:6424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
    3⤵
    PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
      4⤵
      PID:13744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42187.exe
      4⤵
      PID:5160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24715.exe
    3⤵
    PID:11672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
    3⤵
    PID:15400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
    3⤵
    PID:3364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
  2⤵
  PID:8736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30954.exe
    3⤵
    PID:12584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41408.exe
    3⤵
    PID:6620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1635.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1635.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33116.exe
  2⤵
  PID:16864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4308,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
1⤵
PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 12624 -ip 12624
1⤵
PID:15152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 15692 -ip 15692
1⤵
PID:15508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 13660 -ip 13660
1⤵
PID:15564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 15556 -ip 15556
1⤵
PID:16312

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:9600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe

Filesize
468KB

MD5
6b0ae08012e22768f8d2205e4fd60ad6

SHA1
7d652d595b04c94c4550197ed653c6670ce70cf4

SHA256
133c13d4dcdf99e96b4df4c4050b5072e0adac0fd013cd4835578c3c92f8a3a7

SHA512
edc2579a4ed7e3d45dd76547b5d5f5a2fb8ff800f4b760c28ad448d8a1eab6215ab002bd18c88c2a44788c24961a7042cff3ed9c903ca7bc11999f0fc2669077

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe

Filesize
468KB

MD5
32bb19d24d0564ba6c194d9e0cce6e26

SHA1
2bed36aeb70099afd2e9620912cf655b3768870a

SHA256
46d3c061ed6338fe829d0d262b1cdc987922c381743bcbd58316335003c5fb22

SHA512
cc5e445e39b6ba8df481db1513cf95c48e6ea3e4f5c00c63965d226bea9778a1fd7cca431da7e568b51838ad065c33d21bfc0cf28aee6dcbac289956bbda2a3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe

Filesize
468KB

MD5
15bf7ace502af3f84651ad7206c9f59e

SHA1
fc8e9e0df210aaecbbfbd6b39969878cb38a72ec

SHA256
f4d79a0dd8cdb1fc668c0bb9dfc2f8d4d23b2abfa7ca4b4338ae80a9f3f75223

SHA512
5dc26e0c5da8b948db3b17b2bb2f03887bc4937e31da50d2994f1b14747b05bade0a858d91051b337ae73a3c4794a41baa9b2402786a1edc5fb6bc1cf5064dd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe

Filesize
468KB

MD5
3857cc229b6893fbc58431cd90dba8c2

SHA1
61184f71c2d6a9bcd1903497ca73c5bec7d26612

SHA256
53d4a7583e65b704f81ac81659f2d651a12b9cd4cd34fd48920acc4783654aa5

SHA512
0126a554ad464cc0acfe78878da455379ffa1c429e053df9905c236ffed7df1e031bf957477e1253cdb28e83e682135fc4e0e2f5006ed461567ad7a9b307a097

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe

Filesize
468KB

MD5
1c0b230d1b7fbfe047897c8dd138ff80

SHA1
7eaa9960cccff439f63e372a8d4955531fd5a950

SHA256
27e7c55780f326341faa4f8d33841852276e8a0554084b7cb1e33cd599ae1fd4

SHA512
67fcd1f6e22e967ed3c5d966d1dfac17007add7e3bd567e38622ddcea2633774333b2d688839bb9f2afe1e230579fbba0ed231520572ae3dc8201846c2c0bda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe

Filesize
468KB

MD5
b5d24002a7d04642bf50f52b3bd0c801

SHA1
f1bfb38fbfb0874c91d11ed85264859ca27e123d

SHA256
f5503126b5b52b88bfa7912df698c2a040cb313782a52f36813ebc06cb740522

SHA512
791cfef4bcf4062e89175cb1e3c166357c31e67aa708d2cbfbd3ba2d1bbe9526e402c8bdd5c9319eb93fbcab010c551bdfa63c2e411a1684316b724e430fea1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29072.exe

Filesize
468KB

MD5
7453b1c716c491a5057d061fbe5a80d2

SHA1
fe1b28703611405f2ea423c24f0042e82b37e888

SHA256
6d2e5b1bcd6b2ff63ff36f478d4f6634ce4bf9fa2885c033c62301613a360981

SHA512
e86a88f2513322c8218b514d6b69d9d4aa8e4d8ba5ce7ea94e0a47e5021b48c2d206b01fc71aee429e6c734e813ecd7dd24dcddc36dadf77bf1dd595f0dd4da9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31279.exe

Filesize
468KB

MD5
7d10c2b9ef95772df06f97de8ecadcc5

SHA1
58823794d130a93c4df5fe42c6a3a7c85cfa685c

SHA256
3874be443f3a06f28c943ff970775ea5c3bc6f0fe533a1109771bf21263a8657

SHA512
fd0275667cc57f2f6cfed3fcc5cf2cc47cbb08a50f9824015e61562ee96f036671402dcdc06de50acfb05daa1f0a64dbbc63a64cea0dde8bcec68c0ca3a3abdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe

Filesize
468KB

MD5
4d87c182d68279cc887914b306b64ba2

SHA1
12a827e1024143295391c61ae38fb16e0ec6a3eb

SHA256
4bd90b5ed45a20eaee7a9463c24592596cc06fb2b939adfb67ff1a2632c381cf

SHA512
99cfb748ddaeeab3633c9fac155e5527c4d6c44b1a9e367733188fc290afe60b80a2446301a3975dfd948ca06ce02c62a7e8e023d66a1e2ef443aa76abc3060b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34079.exe

Filesize
468KB

MD5
0c7150ab8c6bf6fd08ad81f792957f14

SHA1
6638ef1c52f9a26495cd285da90777ba22062ba6

SHA256
7cb05eeb813d2177166d08b81d58fb970f9245af5f3bd72676b7bc8ac4fc9100

SHA512
5133f8c00feb57ed3356a8d06096fd4d94fc3004ae238122efc24f4fc0425092581266d0a9d701c85b45199a463d818fe0f78849d5dd699461552a29e52ee539

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe

Filesize
468KB

MD5
17278d348278a59c4ffd226b87365a32

SHA1
86aad201a6c643c2696ceba4a7a39567808a8429

SHA256
bb46611ecc3335735527c7c4e779dc9b7d0d009e28f77b335688ea8c98bdd1ca

SHA512
fc3a479a46aa9f5aded4eff226320a721f8259a136a7133f4713e95eef7df703d1cc8ad75a53ed0f1bc5527cb0f162d979cad15b0b50b79f027396eeaa31697a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe

Filesize
468KB

MD5
34175825d41e005cefb16ed7e5618119

SHA1
0a07e0ac28cc00343ebb452d9af380e9d7214a2d

SHA256
ad89652a0640b585fd5dddc25402baeb1e2e4f0bd775f61d37c95878a92b8af9

SHA512
18e76040ff8911318000ad1a0d0e241f8f699750c4e3063985b399b27f88648c18c1b5bff868e01e789fa60e9ea5752e14134dce323d663f94a5e630b93703b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe

Filesize
468KB

MD5
9e11a2381c89ddeec6fdc21cb04caa9f

SHA1
2cae88d4665dbf6051b2a220e640d063a8e9bea7

SHA256
c4c215865f73ed3033ab757104727a92aec688f45c2ac41a1ce3a5919692b636

SHA512
19da8275ab78ad82da8134e5d20b937095e094ab2dfcd2718e74516a0440180a6a32546016100e154d11a5758ce12800f860df88170aed4bca41522131c9dbd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe

Filesize
468KB

MD5
9cb6276b933b54ecf81d052bc192ba7b

SHA1
6785086dd603c2538097130abdf35ff77562ce88

SHA256
1f2fbeb3b93b431fa4f9f9054c8fd361a8be3524b735268033f9f6af80fb4d96

SHA512
b16b7a83767026d95ded02ccd8e9d40c08ff4c2d3169ae32bc4cc7ba808959ca3ebf9e6057e4ea9237c6d402fae7e01890c39afd718a460c680691d4769a268c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39826.exe

Filesize
468KB

MD5
baf21a50c48a9487d19496dac49da646

SHA1
c61d37686bb8b8a05c3ea0796dde006978684920

SHA256
83df3373e48e5a09f8a625b87eff7c0d2679709cfd502a41f29c3bf569438c6c

SHA512
d17db2c6e43a34eae95c2abe287aa15cf1e6c8341f358eae43088cfb785f0215db8c1df932125305a71ac9f59c31be8fae71c665b496d6edc1ba27d0051d121e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe

Filesize
468KB

MD5
6fd95eab55985fc84694656018d0fc07

SHA1
be9f28443fe2b1d900cd88aab4d711e63715d56e

SHA256
25e68cb4a2fd44640e4b2db0470b2df5e0bef5026f8527912b9c2681b3672733

SHA512
03a051a763c92ff2a5b6c32bdde0e9cd22d4f133a39c9317e6c3446d123392a245b4a6cca4ef0792ca2456bd00beed3da95658bda3183998f2ea3539e6e1bf69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43384.exe

Filesize
468KB

MD5
fc0c5a1d54a7a0c7307ee63af4d9ed67

SHA1
b148f736678042239ff8b4c2da0d77df054c006b

SHA256
ef93160afa9bd59a29e7a63ca53f7ef5ea16a7559bef3e0898461f3c183fd265

SHA512
a0915259ee3cc20837de50b46367e969f043a4eabb928b2d12bbaeb550e91ac2251ea6d38adf3e68ab16d2745f0c6fe8c54b1f63e73653f6eef3b67525eb58b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe

Filesize
468KB

MD5
f48a9c9ec073f5e8c0316d94a335a5ad

SHA1
7b1b85d4f4d777a2c76640e559115bcfb1bf3a67

SHA256
f337f19da86dda190df093694ae479eb0447ae2ba547a3de696171a4eff8e193

SHA512
995bbe21a8e215336ed077fb63860e9be6b9954a6066fddd389d03aadaa06b89f4761792abdeedf0a076810e3f0e679234b73c3e99ba0b295d533f7fbe17a2f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47117.exe

Filesize
468KB

MD5
aa6320c413c91aba889d986b7971568e

SHA1
9b4266e8e115b1fc64495050f2d35188f702db28

SHA256
5396579b6667421ab6c862cc96ebdc5cdc463c1c49e4c4dc0e6606cd48a015d1

SHA512
66027723fd02662473238244397d27be6ecc4ab5d493449c92a6b627b97312066f26406d2fc2f72556579f4dbc505f1da6e6c21c1268a9128784f3dd20536420

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe

Filesize
468KB

MD5
81f99bf6106a36d4211992987ffd360c

SHA1
42df82cd5ca4fd0fa5ed42a6bcb38ac3790fc576

SHA256
9134740bd4271af37d2701b5710a321f178fd48aacb37d97a5c06dcd9deee3ad

SHA512
81deb269e3e8c4dc77c69dba632d2366ea732aa28b18322e766098679cf4ee1faf6871e925668eef63f982507a7fd328a1998192286376df93ee72819f3a1326

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48938.exe

Filesize
468KB

MD5
4d7045c356bdcec494ac488044c49a00

SHA1
6bc18644d9850479647b1d55dd649d903ea2bb2b

SHA256
f7286e7df892454fdab70e9d20013cc2b6950a39a26485d1ee5187038133efb0

SHA512
490fab01f7e7c4a7ef64e0a36adb6753d335f3bf776729a03450a3c0afdb2ce93e8d9bce30522b6423ea3ba008a27ece2b710b25173ee26c61c383965612cc38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe

Filesize
468KB

MD5
3ef6061900e8d1e41c8843a47000b840

SHA1
c0dda8b2cdb61291cdb43dcb58b03d8517bde2b4

SHA256
482b863071931d915bd872fc8f5036107e1d7726a3e3405d2a4a9be3363be031

SHA512
c24e2c82d973703cfc961d7414e265ce58b9e0364f520b7af84a069c38a53d2ef3f49c4dcd3ba66e58feb838f6f5c91bb69758bdb8591bcb4e9ca703901a807a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe

Filesize
468KB

MD5
68fedaaf23a911a24f9496def4fd2f40

SHA1
911776fd1730f08f6947213be81c178ebf239258

SHA256
0fe63ddb5a769eb4f4a8731bea02230d5f2534f0c7cf421e1b6a239d0cade4f9

SHA512
7c932bc2b44fd5ad4b68de3a563f576559bb8b5f30876f453df41a21f005b1f72533c3802e4d930b38f52284149a3e960753076ca5d0280b754869a49ab88766

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50578.exe

Filesize
468KB

MD5
ea7624182db9a47a62ec5e676e72c826

SHA1
86e6e14e27a80f65a54a7c239224d189841692f3

SHA256
eb22b1def5ebcd80a86e70659912c66c589f28d4af139a32bad38dbf2b0cb7f9

SHA512
452f8b2fee6b29b48d8948d348856644db4c6c417bdb55fd93770b2f87c781a3d0047a317a9a255b888fc79578ebb311352ebbf308c2e9a81537a1f2e77229c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55513.exe

Filesize
468KB

MD5
03595fa1d13ea1652f2318e1672393a0

SHA1
79fb3522195f7f658eb691cc1c8752ef7dcd9c2d

SHA256
e5b107964cd1792f730fecd7ca6d3dc27565f2474f3d37ef42a09a25cf144bf5

SHA512
ff2e6cbfddcf0474eeed490474edaa5ade9cfa2d770b065711f125767d42d9a7f10ff82e7c174b05490c256bd839f4c7888cd2efbb77bdcade699a10daa8008d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56929.exe

Filesize
468KB

MD5
499258910d05b4b041bc094cd07abe64

SHA1
cb724343705ebbd98b11f258625de51687cff6bc

SHA256
8e17756be015b245beee285d5b4292d3881eeb14a42cd56ae028ffe88718196c

SHA512
d72d4b40d48d8323c6555566ec3718cb4934f4fe8a53cab6f2d593a7faf199dfb20b9133d3c4395dfab1f9836f5b3fe5c92faf5bcd50a6ffa78359a5fb8eaef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe

Filesize
468KB

MD5
29dde9a0f7497a64c35d5ae58009a095

SHA1
5f85bcfc0296ffc0b5d8930facc7ff248b97ecb0

SHA256
cd84d021ab3c549dffac9f282d7355d11819d58937d09a08ef11888e31891858

SHA512
c23c2349cd58c9a6a59244deb07dac52e2947facc8f3ad9759b717d5d8e3855b7dd828304e4b0294229f6ca036163d8aaed83bda6910d7381f58470910346c2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58952.exe

Filesize
468KB

MD5
037f92d3002bea8919292297c6d2e8b2

SHA1
d4275d220e07dce9ec51be41c582267bfe4241da

SHA256
7586902373a873c60be77c1d8912f68e1e44e359cf314c66f8e3408887bb416b

SHA512
d078106574fe02ef2608108433e36ed28313969983c8439df276b96653e69400b3b646b252bba8907e16560fefb837c38e923d6b6397536d6b16522da2d90fd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61265.exe

Filesize
468KB

MD5
1fd07b34ce380dae5a0b6521cb7d9b45

SHA1
3f191cc0bb420e2af87ff139a9165aaa9ab20af8

SHA256
de0bbb7f7b46056daec3f31909686ad527a26ee32dabad3c0f159e4834862381

SHA512
7948ff48a94477c698aa06012bbf80cebf4b89b0a135ce96db62fe5de7201b26c579e0ee6a1503061554e1daa0980ac9f85ea6744efb124dd8c395c175d03e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe

Filesize
468KB

MD5
f7816f83cfd67557ca3bfa2b20cbf05a

SHA1
a6bbd2a76a39590aebe44a9c72ddd605ff29d15d

SHA256
392e6e78ddcf7c82256617bf3c82a7d08478f7eebb5ded0c17cd35aa970a60ba

SHA512
990542693e25601533999c5c0574f1e3665af9f3dc0c0cc77f8dafad5d6ff2e0ad3c99bdad8e7e7e180b163991416f8c9a30f786d651d6b0be85d2203fdabf8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63250.exe

Filesize
468KB

MD5
b1d33bba626acb03e6aa503c156f54b6

SHA1
d0ee00af1db51e8a94753e4cfa01fe8eddfff4b9

SHA256
a8d8a514dd5dc5f0a5ffa6360517368452383765d2eeb0de66cb06dac96bf0f8

SHA512
b730daf9fc5bf504c1bfc56bde75920bcaa7d538e6fa42874e42f3d0751a6bb0da6d4bf7dc057eccca77133d35608a233b3b99e3b9e3a30e8476c7c39ae0fe5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe

Filesize
468KB

MD5
42de48ce3a9a40d8f66e95fc19869866

SHA1
a3947c350246cf1c7edbd28da20c4e485e2d2b88

SHA256
5617563e9a33bf09d060f5a8b2c53d82c9bfe3f6bb598eba79f1cad029829b23

SHA512
30897f9e3285cd2a5590758a130fd39d73aa8d25c3d1822d51fd606ecae77ceccec1695180947dabf35f9cdcb6cbd9a678ba9cb61b3ff5e46ab4348bfbe463d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe

Filesize
468KB

MD5
992a3b192eb5af6f262a57345d89a6a3

SHA1
03ad7093f83ee46216ed7c1abe773a5d01ab08a5

SHA256
2e6be9291a0ad3e67fe856753f9dc065a0a0d22cfe4e79f404da9fcb70b86b8c

SHA512
804917975bcfafdc49c255c32dcddb1a3f2989be4182256a13b7a021506167a632f76f1cb6dc361e3909d7dc8511efd83beb9983e98f4f8a7b603359b741acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe

Filesize
468KB

MD5
4d713bf0a898968f6014788639165c35

SHA1
850f0eb43b34a29e3e755b07a93c127640e97f77

SHA256
41f331a9fd0af8dfa4c7267f38711ee699e3995b4fb66adb028083a9bbb92d93

SHA512
1b7468a912a7eb0494c09301e0b99f5938540286f6412a4f285c0a3a4dbc6cad69d4f0e77787c6125b73b6088cfb73901021ecb3f64b51036967f0c91a6b4983

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe

Filesize
468KB

MD5
ee92e922c7c85aa74be820a082c35f56

SHA1
db60bd2518ae3f4b8e01f8bc9410ef3adfae4be8

SHA256
abbbb99c4ac5e9a68a5960277b50db1a7d37a4724042d1aa53c87fbc188f3d29

SHA512
55885785c60beba25b236a28b28b1801063f5904ab9eb44c8c15d3128cb902d47df2941389505cddc66a998a16a451a0c4fc0edc0815c9637925affa60753d77

Download Submit
memory/380-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/704-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/748-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1000-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1096-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1168-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1464-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1888-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2632-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2720-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3412-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3444-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3540-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3768-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3832-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3848-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3968-583-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4056-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4080-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4152-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4268-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4496-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4560-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4596-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4612-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4776-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5144-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5180-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5188-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5256-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-585-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-592-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5356-590-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5400-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5412-591-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5416-593-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5428-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5432-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5488-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5508-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5532-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5548-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5564-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5572-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5600-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5620-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5628-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5652-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5668-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5684-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5716-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5840-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5952-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5960-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5964-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5984-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6036-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6044-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6116-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13660-2599-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15472-2597-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15964-2568-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16020-2565-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16176-2556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16224-2563-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads