8f370ab8967bd57213594e883c20d4ac0bdfd8aa7e90b849a1fcb22a752d7d41

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

405d61fad57589f9a9f2a6f8a636c350N.exe
Size

468KB
MD5

405d61fad57589f9a9f2a6f8a636c350
SHA1

301b4a91ffe0464170dc10180f3d4f4bed45a863
SHA256

8f370ab8967bd57213594e883c20d4ac0bdfd8aa7e90b849a1fcb22a752d7d41
SHA512

6a74168ebbb21ac88e26a5523b5a610409c8a4d173e95be710cf95057854d95926767d8eb9f4b36b594851ac34816963e3346d60d3658a1c31d109210a5f33b0
SSDEEP

3072:1O4ogIdId5jtbYGPOtjcc8I52S4P3p5ymHekVqhRQscRcQ6BAnl6:1Vowbjt5POjcc4ZihRQ1KpBA

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2876	Unicorn-48575.exe
1516	Unicorn-11972.exe
1560	Unicorn-45475.exe
1448	Unicorn-1208.exe
2464	Unicorn-30626.exe
4032	Unicorn-44362.exe
2836	Unicorn-42591.exe
932	Unicorn-39292.exe
4064	Unicorn-9068.exe
3308	Unicorn-22271.exe
4932	Unicorn-58653.exe
3632	Unicorn-60921.exe
2468	Unicorn-38346.exe
4960	Unicorn-13755.exe
4804	Unicorn-55565.exe
3708	Unicorn-40118.exe
2940	Unicorn-31391.exe
652	Unicorn-7422.exe
5048	Unicorn-63069.exe
2908	Unicorn-5886.exe
4392	Unicorn-56004.exe
2548	Unicorn-8693.exe
2764	Unicorn-54630.exe
4244	Unicorn-8958.exe
760	Unicorn-54630.exe
772	Unicorn-47423.exe
2592	Unicorn-671.exe
3272	Unicorn-20537.exe
3448	Unicorn-20271.exe
4812	Unicorn-42815.exe
4832	Unicorn-39970.exe
4896	Unicorn-12280.exe
1344	Unicorn-55242.exe
3064	Unicorn-17765.exe
1752	Unicorn-8635.exe
1488	Unicorn-41142.exe
4448	Unicorn-35173.exe
964	Unicorn-29573.exe
4052	Unicorn-26617.exe
3596	Unicorn-44214.exe
3176	Unicorn-55843.exe
2936	Unicorn-12584.exe
4508	Unicorn-32450.exe
2996	Unicorn-51007.exe
4912	Unicorn-11846.exe
2304	Unicorn-34733.exe
3388	Unicorn-49471.exe
4340	Unicorn-49471.exe
5000	Unicorn-39965.exe
680	Unicorn-42765.exe
3944	Unicorn-47484.exe
3764	Unicorn-17526.exe
3716	Unicorn-47712.exe
2188	Unicorn-27404.exe
5068	Unicorn-33535.exe
3480	Unicorn-33535.exe
372	Unicorn-51543.exe
3968	Unicorn-60473.exe
3152	Unicorn-43452.exe
2644	Unicorn-43452.exe
868	Unicorn-56617.exe
4880	Unicorn-56617.exe
1472	Unicorn-43103.exe
2184	Unicorn-62969.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5244	3368	WerFault.exe	232
15856	14984	WerFault.exe	699

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18519.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
15444	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15976	dwm.exe
Token: SeChangeNotifyPrivilege	15976	dwm.exe
Token: 33	15976	dwm.exe
Token: SeIncBasePriorityPrivilege	15976	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4604	405d61fad57589f9a9f2a6f8a636c350N.exe
2876	Unicorn-48575.exe
1516	Unicorn-11972.exe
1560	Unicorn-45475.exe
1448	Unicorn-1208.exe
4032	Unicorn-44362.exe
2464	Unicorn-30626.exe
2836	Unicorn-42591.exe
932	Unicorn-39292.exe
4064	Unicorn-9068.exe
4932	Unicorn-58653.exe
3308	Unicorn-22271.exe
2468	Unicorn-38346.exe
3632	Unicorn-60921.exe
4960	Unicorn-13755.exe
4804	Unicorn-55565.exe
3708	Unicorn-40118.exe
2940	Unicorn-31391.exe
652	Unicorn-7422.exe
5048	Unicorn-63069.exe
4392	Unicorn-56004.exe
2908	Unicorn-5886.exe
760	Unicorn-54630.exe
2764	Unicorn-54630.exe
4244	Unicorn-8958.exe
2548	Unicorn-8693.exe
772	Unicorn-47423.exe
3448	Unicorn-20271.exe
3272	Unicorn-20537.exe
2592	Unicorn-671.exe
4812	Unicorn-42815.exe
4832	Unicorn-39970.exe
4896	Unicorn-12280.exe
1344	Unicorn-55242.exe
3064	Unicorn-17765.exe
1752	Unicorn-8635.exe
1488	Unicorn-41142.exe
964	Unicorn-29573.exe
4448	Unicorn-35173.exe
4508	Unicorn-32450.exe
4052	Unicorn-26617.exe
3596	Unicorn-44214.exe
2936	Unicorn-12584.exe
3176	Unicorn-55843.exe
2996	Unicorn-51007.exe
4912	Unicorn-11846.exe
3388	Unicorn-49471.exe
4340	Unicorn-49471.exe
2304	Unicorn-34733.exe
5000	Unicorn-39965.exe
680	Unicorn-42765.exe
3944	Unicorn-47484.exe
3764	Unicorn-17526.exe
3716	Unicorn-47712.exe
5068	Unicorn-33535.exe
2188	Unicorn-27404.exe
3480	Unicorn-33535.exe
3152	Unicorn-43452.exe
372	Unicorn-51543.exe
3968	Unicorn-60473.exe
1572	Unicorn-9859.exe
868	Unicorn-56617.exe
4880	Unicorn-56617.exe
4216	Unicorn-62704.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 2876	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	89
PID 4604 wrote to memory of 2876	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	89
PID 4604 wrote to memory of 2876	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	89
PID 2876 wrote to memory of 1516	2876	Unicorn-48575.exe	92
PID 2876 wrote to memory of 1516	2876	Unicorn-48575.exe	92
PID 2876 wrote to memory of 1516	2876	Unicorn-48575.exe	92
PID 4604 wrote to memory of 1560	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	93
PID 4604 wrote to memory of 1560	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	93
PID 4604 wrote to memory of 1560	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	93
PID 1516 wrote to memory of 1448	1516	Unicorn-11972.exe	95
PID 1516 wrote to memory of 1448	1516	Unicorn-11972.exe	95
PID 1516 wrote to memory of 1448	1516	Unicorn-11972.exe	95
PID 2876 wrote to memory of 2464	2876	Unicorn-48575.exe	97
PID 2876 wrote to memory of 2464	2876	Unicorn-48575.exe	97
PID 2876 wrote to memory of 2464	2876	Unicorn-48575.exe	97
PID 4604 wrote to memory of 4032	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	98
PID 4604 wrote to memory of 4032	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	98
PID 4604 wrote to memory of 4032	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	98
PID 1560 wrote to memory of 2836	1560	Unicorn-45475.exe	100
PID 1560 wrote to memory of 2836	1560	Unicorn-45475.exe	100
PID 1560 wrote to memory of 2836	1560	Unicorn-45475.exe	100
PID 4032 wrote to memory of 932	4032	Unicorn-44362.exe	101
PID 4032 wrote to memory of 932	4032	Unicorn-44362.exe	101
PID 4032 wrote to memory of 932	4032	Unicorn-44362.exe	101
PID 4604 wrote to memory of 4064	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	102
PID 4604 wrote to memory of 4064	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	102
PID 4604 wrote to memory of 4064	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	102
PID 1448 wrote to memory of 3308	1448	Unicorn-1208.exe	103
PID 1448 wrote to memory of 3308	1448	Unicorn-1208.exe	103
PID 1448 wrote to memory of 3308	1448	Unicorn-1208.exe	103
PID 1516 wrote to memory of 4932	1516	Unicorn-11972.exe	104
PID 1516 wrote to memory of 4932	1516	Unicorn-11972.exe	104
PID 1516 wrote to memory of 4932	1516	Unicorn-11972.exe	104
PID 2464 wrote to memory of 3632	2464	Unicorn-30626.exe	105
PID 2464 wrote to memory of 3632	2464	Unicorn-30626.exe	105
PID 2464 wrote to memory of 3632	2464	Unicorn-30626.exe	105
PID 2876 wrote to memory of 2468	2876	Unicorn-48575.exe	106
PID 2876 wrote to memory of 2468	2876	Unicorn-48575.exe	106
PID 2876 wrote to memory of 2468	2876	Unicorn-48575.exe	106
PID 2836 wrote to memory of 4960	2836	Unicorn-42591.exe	107
PID 2836 wrote to memory of 4960	2836	Unicorn-42591.exe	107
PID 2836 wrote to memory of 4960	2836	Unicorn-42591.exe	107
PID 1560 wrote to memory of 4804	1560	Unicorn-45475.exe	108
PID 1560 wrote to memory of 4804	1560	Unicorn-45475.exe	108
PID 1560 wrote to memory of 4804	1560	Unicorn-45475.exe	108
PID 932 wrote to memory of 3708	932	Unicorn-39292.exe	109
PID 932 wrote to memory of 3708	932	Unicorn-39292.exe	109
PID 932 wrote to memory of 3708	932	Unicorn-39292.exe	109
PID 4032 wrote to memory of 2940	4032	Unicorn-44362.exe	110
PID 4032 wrote to memory of 2940	4032	Unicorn-44362.exe	110
PID 4032 wrote to memory of 2940	4032	Unicorn-44362.exe	110
PID 4064 wrote to memory of 652	4064	Unicorn-9068.exe	111
PID 4064 wrote to memory of 652	4064	Unicorn-9068.exe	111
PID 4064 wrote to memory of 652	4064	Unicorn-9068.exe	111
PID 4604 wrote to memory of 5048	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	112
PID 4604 wrote to memory of 5048	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	112
PID 4604 wrote to memory of 5048	4604	405d61fad57589f9a9f2a6f8a636c350N.exe	112
PID 4932 wrote to memory of 2908	4932	Unicorn-58653.exe	113
PID 4932 wrote to memory of 2908	4932	Unicorn-58653.exe	113
PID 4932 wrote to memory of 2908	4932	Unicorn-58653.exe	113
PID 1516 wrote to memory of 4392	1516	Unicorn-11972.exe	114
PID 1516 wrote to memory of 4392	1516	Unicorn-11972.exe	114
PID 1516 wrote to memory of 4392	1516	Unicorn-11972.exe	114
PID 2876 wrote to memory of 2548	2876	Unicorn-48575.exe	115

C:\Users\Admin\AppData\Local\Temp\405d61fad57589f9a9f2a6f8a636c350N.exe
"C:\Users\Admin\AppData\Local\Temp\405d61fad57589f9a9f2a6f8a636c350N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17765.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
        7⤵
        Executes dropped EXE
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        9⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47179.exe
        10⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        10⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21809.exe
        9⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35609.exe
        9⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37927.exe
        9⤵
        
        PID:18092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30440.exe
        8⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44107.exe
        9⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        9⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        8⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        8⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        8⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        8⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        8⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27615.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        7⤵
        
        PID:17116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9859.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38905.exe
        7⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17026.exe
        8⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
        9⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        9⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18350.exe
        8⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13039.exe
        8⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40107.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        7⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39712.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19293.exe
        7⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54969.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
        8⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
        8⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17304.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11835.exe
        7⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        7⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41376.exe
        6⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        7⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60594.exe
        6⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51007.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        8⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10820.exe
        9⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47557.exe
        10⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        10⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe
        10⤵
        
        PID:16784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        10⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56364.exe
        9⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24271.exe
        9⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        9⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32085.exe
        8⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        8⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61673.exe
        8⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        8⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
        7⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
        8⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        8⤵
        
        PID:16288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36819.exe
        7⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59302.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        7⤵
        
        PID:16200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26594.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        8⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        8⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
        8⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12879.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28412.exe
        7⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55971.exe
        7⤵
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        6⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21399.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11846.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37119.exe
        6⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        8⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
        8⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29787.exe
        8⤵
        
        PID:18288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        7⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30415.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        7⤵
        
        PID:16572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39318.exe
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
        6⤵
        
        PID:18244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45235.exe
        5⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
        7⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        7⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        7⤵
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30415.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64636.exe
        6⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34920.exe
        5⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47179.exe
        6⤵
        
        PID:13904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        6⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29755.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19077.exe
        5⤵
        
        PID:18424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26617.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2552.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        8⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47557.exe
        9⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        9⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56985.exe
        9⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        9⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        8⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4801.exe
        8⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24564.exe
        8⤵
        
        PID:18420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43310.exe
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4562.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        7⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        7⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
        7⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12645.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55362.exe
        8⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        8⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17284.exe
        8⤵
        
        PID:18336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        7⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        7⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31164.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        7⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
        7⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe
        7⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
        7⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe
        6⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56252.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37506.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe
        8⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53859.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        7⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32046.exe
        6⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        7⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38274.exe
        8⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        8⤵
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        7⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64601.exe
        7⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35475.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39033.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39520.exe
        6⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38167.exe
        6⤵
        
        PID:9704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43402.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49602.exe
        6⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24072.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
        7⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56150.exe
        6⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
        6⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55971.exe
        6⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27644.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52844.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64473.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        6⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20276.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        5⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8844.exe
        5⤵
        
        PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56004.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32450.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5624.exe
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29765.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        9⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        9⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        9⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15064.exe
        8⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        8⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62552.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21829.exe
        8⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        8⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
        7⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4133.exe
        7⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
        7⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
        6⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        7⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        7⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41689.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe
        6⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe
        6⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe
        6⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        7⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        7⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
        7⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27953.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
        6⤵
        
        PID:12328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7455.exe
        6⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exe
        5⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10427.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        5⤵
        
        PID:13548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        5⤵
        
        PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65093.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        7⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37930.exe
        7⤵
        
        PID:18248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53456.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10509.exe
        6⤵
        
        PID:17552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41131.exe
        5⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16018.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
        5⤵
        
        PID:14848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62357.exe
        5⤵
        
        PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39642.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        6⤵
        
        PID:13608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        5⤵
        
        PID:13596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64636.exe
        5⤵
        
        PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
      4⤵
      PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4993.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
        5⤵
        
        PID:10604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30770.exe
      4⤵
      PID:9448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8224.exe
      4⤵
      PID:14068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
      4⤵
      PID:16780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30626.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60921.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44214.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22830.exe
        7⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        8⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30498.exe
        8⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53843.exe
        7⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59967.exe
        7⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
        7⤵
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59677.exe
        6⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15957.exe
        8⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58599.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28008.exe
        7⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36738.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54399.exe
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10920.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38670.exe
        6⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49532.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        7⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45701.exe
        8⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        8⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        8⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        7⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
        7⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
        7⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35630.exe
        6⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42571.exe
        7⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        7⤵
        
        PID:17320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        6⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        6⤵
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe
        6⤵
        
        PID:17504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30028.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55362.exe
        7⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        7⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe
        7⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22408.exe
        7⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        6⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        6⤵
        
        PID:16396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        6⤵
        
        PID:17744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55231.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22546.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe
        6⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
        6⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8031.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
        5⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        5⤵
        
        PID:16468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19574.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46633.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
        8⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        8⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
        7⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1595.exe
        7⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        7⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43461.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
        7⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37890.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55660.exe
        6⤵
        
        PID:18056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48403.exe
        5⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        7⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        7⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12879.exe
        6⤵
        
        PID:10912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28412.exe
        6⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22081.exe
        5⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
        6⤵
        
        PID:18320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31583.exe
        5⤵
        
        PID:10328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12689.exe
        5⤵
        
        PID:14100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        5⤵
        
        PID:940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21686.exe
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exe
        6⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        7⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        7⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        7⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18088.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        6⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-552.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50504.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8811.exe
        6⤵
        
        PID:14812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41433.exe
        6⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57686.exe
        5⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21563.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        5⤵
        
        PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45235.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
        5⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58114.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        5⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49721.exe
        5⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33780.exe
        5⤵
        
        PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34920.exe
      4⤵
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
        5⤵
        
        PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        5⤵
        
        PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57033.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe
      4⤵
      PID:13964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34970.exe
      4⤵
      PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38346.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39243.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        7⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
        7⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
        7⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11535.exe
        6⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55999.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55852.exe
        6⤵
        
        PID:18088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
        6⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
        5⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe
        5⤵
        
        PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29814.exe
        5⤵
        
        PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
      4⤵
      PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18440.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33170.exe
        6⤵
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
        6⤵
        
        PID:8380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30415.exe
        5⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        5⤵
        
        PID:16640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
      4⤵
      PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
        5⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
        5⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54078.exe
        5⤵
        
        PID:18140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
      4⤵
      PID:9580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe
      4⤵
      PID:14288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9178.exe
      4⤵
      PID:10480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe
      4⤵
      PID:7152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5450.exe
        6⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36805.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
        7⤵
        
        PID:18308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56150.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        6⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12913.exe
        5⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57538.exe
        6⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63151.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        6⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-379.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        5⤵
        
        PID:15020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
        5⤵
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9311.exe
        5⤵
        
        PID:9636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28706.exe
      4⤵
      PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43970.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50192.exe
        6⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59943.exe
        6⤵
        
        PID:18208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        5⤵
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        5⤵
        
        PID:16440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
      4⤵
      PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2786.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16273.exe
      4⤵
      PID:15004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5919.exe
      4⤵
      PID:8252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39965.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38399.exe
        5⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
        6⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
        5⤵
        
        PID:12692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        5⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34448.exe
        5⤵
        
        PID:18344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
      4⤵
      PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14468.exe
        5⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6660.exe
        5⤵
        
        PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
      4⤵
      PID:9540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
      4⤵
      PID:13940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55971.exe
      4⤵
      PID:1984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5509.exe
    3⤵
    PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
      4⤵
      PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39184.exe
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
      4⤵
      PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21745.exe
    3⤵
    PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
      4⤵
      PID:12000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64200.exe
      4⤵
      PID:17452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52567.exe
    3⤵
    PID:9348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28358.exe
    3⤵
    PID:14264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50326.exe
    3⤵
    PID:8296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42591.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47484.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
        8⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2762.exe
        9⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        9⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        9⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:18100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        8⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51481.exe
        8⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18750.exe
        8⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        8⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
        8⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39184.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        7⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18704.exe
        7⤵
        
        PID:18264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52957.exe
        6⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        8⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44841.exe
        8⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39184.exe
        7⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        7⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        7⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24015.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        7⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
        7⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        7⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        6⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        6⤵
        
        PID:14272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
        6⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62021.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        7⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30498.exe
        7⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2350.exe
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
        6⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        7⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        7⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe
        7⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60051.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
        6⤵
        
        PID:14984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14984 -s 464
        7⤵
        Program crash
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21154.exe
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2397.exe
        6⤵
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3387.exe
        5⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exe
        5⤵
        
        PID:11632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26171.exe
        5⤵
        
        PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-671.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60473.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15941.exe
        6⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28866.exe
        8⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        8⤵
        
        PID:16692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        7⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        7⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18763.exe
        6⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39918.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        6⤵
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        6⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13653.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        5⤵
        
        PID:17108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        5⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        5⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65391.exe
        5⤵
        
        PID:18296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
      4⤵
      PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
        5⤵
        
        PID:8352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11089.exe
      4⤵
      PID:10940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39410.exe
      4⤵
      PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
      4⤵
      PID:8644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55565.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33535.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
        8⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63361.exe
        8⤵
        
        PID:17520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59186.exe
        7⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33880.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        7⤵
        
        PID:16388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37928.exe
        6⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17999.exe
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        6⤵
        
        PID:13656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36785.exe
        5⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18350.exe
        6⤵
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40217.exe
        6⤵
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
        6⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44176.exe
        5⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
        5⤵
        
        PID:15612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50464.exe
        5⤵
        
        PID:8224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56617.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10634.exe
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        6⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
        6⤵
        
        PID:17404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        5⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1423.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64441.exe
        5⤵
        
        PID:16088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe
      4⤵
      PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        5⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
        6⤵
        
        PID:13480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5017.exe
        6⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        5⤵
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        5⤵
        
        PID:16304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25855.exe
      4⤵
      PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
      4⤵
      PID:12380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29826.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe
        7⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        7⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        6⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-875.exe
        6⤵
        
        PID:17536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5864.exe
        5⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10536.exe
        6⤵
        
        PID:13540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        6⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
        5⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        5⤵
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41244.exe
      4⤵
      PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        5⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        6⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        5⤵
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        5⤵
        
        PID:16588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21873.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        5⤵
        
        PID:8964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37951.exe
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
      4⤵
      PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57413.exe
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40779.exe
        5⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10609.exe
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28251.exe
        6⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31832.exe
        5⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        5⤵
        
        PID:16820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
      4⤵
      PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
      4⤵
      PID:11964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
      4⤵
      PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
      4⤵
      PID:15492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12669.exe
      4⤵
      PID:10740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27781.exe
    3⤵
    PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58114.exe
      4⤵
      PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
      4⤵
      PID:8700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
      4⤵
      PID:16296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe
    3⤵
    PID:8480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26714.exe
    3⤵
    PID:11744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60935.exe
    3⤵
    PID:16204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39292.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe
        6⤵
        Executes dropped EXE
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        7⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        8⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        8⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34306.exe
        8⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58601.exe
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        7⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8394.exe
        7⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        7⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        7⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8404.exe
        6⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56617.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        8⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        8⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42210.exe
        8⤵
        
        PID:18220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
        7⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        7⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55718.exe
        6⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22984.exe
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        6⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        5⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29692.exe
        6⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        7⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        6⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25855.exe
        5⤵
        
        PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        5⤵
        
        PID:18324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
        8⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        8⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
        8⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9554.exe
        7⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        7⤵
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
        6⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        6⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        6⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42422.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
        7⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16475.exe
        7⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        6⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        5⤵
        
        PID:16024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
      4⤵
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53314.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        6⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4801.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10670.exe
        5⤵
        
        PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
      4⤵
      PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13639.exe
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37745.exe
        5⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        5⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64618.exe
        5⤵
        
        PID:9832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
      4⤵
      PID:10896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31391.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19490.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
        6⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53899.exe
        7⤵
        
        PID:17272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39184.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        6⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37721.exe
        5⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        5⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
        5⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54715.exe
        5⤵
        
        PID:13436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
        5⤵
        
        PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43103.exe
      4⤵
      Executes dropped EXE
      PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35147.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        6⤵
        
        PID:16236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12651.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43350.exe
        5⤵
        
        PID:11368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11835.exe
        5⤵
        
        PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10965.exe
      4⤵
      PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59330.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        5⤵
        
        PID:11280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        5⤵
        
        PID:13516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23932.exe
      4⤵
      PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44000.exe
      4⤵
      PID:10244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
      4⤵
      PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33535.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
        5⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        6⤵
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        6⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25855.exe
        5⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        5⤵
        
        PID:12336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7691.exe
        5⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60137.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        5⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        5⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
        5⤵
        
        PID:15604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16085.exe
      4⤵
      PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
      4⤵
      PID:400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9768.exe
      4⤵
      PID:13816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
      4⤵
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        5⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45820.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
        5⤵
        
        PID:16060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5461.exe
      4⤵
      PID:8884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe
      4⤵
      PID:12728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
      4⤵
      PID:7348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
    3⤵
    PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23880.exe
      4⤵
      PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
      4⤵
      PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
      4⤵
      PID:16356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2807.exe
    3⤵
    PID:12428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
    3⤵
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
    3⤵
    PID:9260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7422.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        5⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        6⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        7⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        8⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63417.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        7⤵
        
        PID:15576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30440.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        6⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        6⤵
        
        PID:11660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        6⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
        5⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
        5⤵
        
        PID:12424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        5⤵
        
        PID:14016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
      4⤵
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9665.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26373.exe
        6⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        7⤵
        
        PID:17304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19249.exe
        6⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19494.exe
        6⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        5⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        6⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34030.exe
        5⤵
        
        PID:18104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe
      4⤵
      PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        5⤵
        
        PID:10848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        5⤵
        
        PID:16244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
      4⤵
      PID:8328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47715.exe
      4⤵
      PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5198.exe
      4⤵
      PID:16216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35173.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40668.exe
      4⤵
      PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34242.exe
        5⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        6⤵
        
        PID:12932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23552.exe
        6⤵
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63919.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51481.exe
        5⤵
        
        PID:12892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        5⤵
        
        PID:16796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        5⤵
        
        PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6418.exe
      4⤵
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23536.exe
        5⤵
        
        PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
      4⤵
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
      4⤵
      PID:14240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
      4⤵
      PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50122.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
      4⤵
      PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23880.exe
        5⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        5⤵
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58576.exe
        5⤵
        
        PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
      4⤵
      PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
      4⤵
      PID:12360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
      4⤵
      PID:15344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25451.exe
      4⤵
      PID:8924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
    3⤵
    PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7976.exe
      4⤵
      PID:14012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64796.exe
      4⤵
      PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54886.exe
    3⤵
    PID:8740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
    3⤵
    PID:14320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61505.exe
    3⤵
    PID:18348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
      4⤵
      PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55112.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27944.exe
        6⤵
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        6⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2086.exe
        6⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        5⤵
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
        5⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4619.exe
        5⤵
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
      4⤵
      PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe
        5⤵
        
        PID:13064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        5⤵
        
        PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10831.exe
      4⤵
      PID:9500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
      4⤵
      PID:13852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
      4⤵
      PID:15900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41954.exe
    3⤵
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exe
      4⤵
      PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        5⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62032.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34306.exe
        5⤵
        
        PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45490.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57299.exe
      4⤵
      PID:11312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
      4⤵
      PID:14168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50521.exe
    3⤵
    PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
      4⤵
      PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43976.exe
        5⤵
        
        PID:14428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25448.exe
      4⤵
      PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
      4⤵
      PID:13948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51327.exe
    3⤵
    PID:6680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
    3⤵
    PID:10140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe
    3⤵
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26293.exe
    3⤵
    PID:16808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
    3⤵
    PID:8072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
    3⤵
    PID:512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62959.exe
      4⤵
      PID:3368
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 492
        5⤵
        Program crash
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
      4⤵
      PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
      4⤵
      PID:12508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47392.exe
      4⤵
      PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe
      4⤵
      PID:11036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
    3⤵
    PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
      4⤵
      PID:8920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
      4⤵
      PID:12572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17685.exe
      4⤵
      PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe
      4⤵
      PID:8428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
    3⤵
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
    3⤵
    PID:11276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
    3⤵
    PID:7632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19525.exe
    3⤵
    PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
      4⤵
      PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
      4⤵
      PID:11464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
    3⤵
    PID:12344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29820.exe
    3⤵
    PID:3036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58958.exe
    3⤵
    PID:3576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51034.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51034.exe
  2⤵
  PID:6672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
    3⤵
    PID:10756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
    3⤵
    PID:13804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
    3⤵
    PID:14960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47232.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47232.exe
  2⤵
  PID:9364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32558.exe
  2⤵
  PID:14412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39892.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39892.exe
  2⤵
  PID:16564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
  2⤵
  PID:6752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3368 -ip 3368
1⤵
PID:7720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 14188 -ip 14188
1⤵
PID:15892

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:15444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe

Filesize
468KB

MD5
8a946dc7d759ad75556b36ac90d53b58

SHA1
9f2d578b4b51dd010bb865b67873ea5a2c802807

SHA256
526b8100729305fa3e01d6c869027a2961736082a4608398c20f61d802643222

SHA512
0983bb80812f6b28cefcd4241f346bc3ceacd5123344f6e27a1813cdee913b2a2be20017f0ca47a446079738a5471a934388413f7bec0de77e013cbfe1caea42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe

Filesize
468KB

MD5
ba2c6f24e1505f86ec71262b1c49d0cd

SHA1
e548487b2bfbc11425d9caf3bbe0aa686e1aff66

SHA256
5fda6cdd1e46bef0aed35b0d4e06e9b5dded0c223ea8b36d1f83164871fe45fd

SHA512
12bf5ddca1177d99782f1464579efaf800ddf62ae6b83daf736525aba3e383bf1c24c272eb6cb1ee91eaa2398e70b03275c6b94b26b1b70922b58c59b1edcb32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe

Filesize
468KB

MD5
ff1d3edb2c27ad7ecf1d1cdd8f5593f4

SHA1
41c89257a945772a8a47dd592c52beecad4ee99b

SHA256
c26ab69757117c670f078c868ec53a9dadcc413b4eed4c9d02e0b36cf4ae23da

SHA512
638f02a835dd0916af5e04c9e8383971dbb77d05a9f4f1f59777dfbbe84df286c37f8930814a20611d25656b132ff5731953c07e03413f3139eada7502af3632

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe

Filesize
468KB

MD5
9318347c1842f20f73851c17d9ab65d8

SHA1
c9a173d826d291a357eb9157869a60c2f263238a

SHA256
1ba2bd652ea984988ce6248c4a47d0efa3f210bc9c495539fd398d2a03fe03f7

SHA512
a5e8eb50d286f721aecf9803361c28f98e27e3e02b64cfb3f3536b1aa05fb47d938a68898c63a3a71fda5a06876cf9c990e3c9c5adfcebedfc77e96ec271b4e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe

Filesize
468KB

MD5
2990e7ecbe8cd10ff3d6094b6afdc95b

SHA1
5b2829e1e0937073cd523a560fdb7f5a1aee26a8

SHA256
cd909fb43628cd23dce7a49edbac8c68f91f80b582a6b959da21450a625cc1ad

SHA512
5f9a6635d6685b4c0fb0cdfe6291baf36af91bb55b4041f917b7f6fc502989511b561e91a6e8422769fabc2849c55aea14ce6a2816f825304d06e2e8bfc4fd2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe

Filesize
468KB

MD5
0929abf0a92a8382a43d66dcf8e21d24

SHA1
b6fce228d8af0d9cee5c2926284d96a01d3bfbee

SHA256
9b781d50e50bb5cf4da49dd9e3e46606c62c747abc22500df47342a1663d9661

SHA512
0ea610a1281b2d56f3eb17c24af160e58a208790173b92ff8b026d0f775876a82871d8c61f1736006415f7fe38fb7b1c68eb48a1c2fbef4a108b86e8d0aa9616

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe

Filesize
468KB

MD5
8153626e5a5e06e0f6f726f1e9bd4884

SHA1
0d09a07845138ee1a4f86072eb6755c3a6aa6717

SHA256
52f29eb821d70698d5357d7d742c7090a521a3d93fcc98a1552df76891c569fe

SHA512
493bc0b0abf3a999567a8cc0cb7693c2e7ba51cd3c662c11f2c81d8364e4a3d4ead50364f81987790e5dd2dfc75336fff80022d2b777e2b59e0061a252a840ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe

Filesize
468KB

MD5
50931bfabd97275a7f5aae5c1ccbafd3

SHA1
c2f796bf06c62953503e57d019f272671586737a

SHA256
24c77f54ea5abe7eff91b3231ffa4303e8f244af5da3dd3a39c13736d8b52bc7

SHA512
138e8b241c548fb95722f9c02a6119697e3f7b4a1727c4a40c6f16f61e7eef7753abbaaa55d951aed710e8f601b56a834638022a38a95b8996030d57fe60c3ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2552.exe

Filesize
468KB

MD5
d2f5a24764a96851d7711d4fb18fbe42

SHA1
ea09812b183c2d9cc9e774a8936103c95b7aeb99

SHA256
6f120de89ac77e11d2e8ee621b06eace4eeb1ac80d71e13c13fbfe9a4be622c7

SHA512
e5f335aa753de4f3c41eb6899ce16de52e3b05dda9e7f581210a09dc0f92b667902d9110a2e9e5ff98ac6312d3c3f49ceb430e9d53b5ca21bc5b24263db8e87d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30626.exe

Filesize
468KB

MD5
fa43bb049718f4c01bc39c08eae83a09

SHA1
dd596bdbcf68aad18ac6caa0482df729a4edec8c

SHA256
42860ecd84c3ad8284905d013a391054e9ba13850751de9e65c6171d1b00cdba

SHA512
fdbbfc715a2cb424fe7651acb78ded35b7a52af2e1595ecbece048cbe6ae939296814a3950a41e4727a309c3a5461264ce04657ebdae6a53e253848cbdce15f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31391.exe

Filesize
468KB

MD5
02b07e22c308153bf3900b28dadd72b1

SHA1
31dbe1498a8562e02931fb804ebd7ec5e138ee7c

SHA256
08d1e1fc729c241e9f218e90865a41e9c5609d24bc029e774dc745e0ec2142dd

SHA512
24298ea98a446e51fffda078a7546181c219479fc38d72e1a13899c542e0b02fd0890aa794de502e6305316a0370939be81e42eb6979409267a2ba1e3a9cf1d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38346.exe

Filesize
468KB

MD5
e2bd12ec0c569d38e1e0c4352a0177df

SHA1
e8eab1fa08cf5175f7b6c172e73be1ddb98b8ff5

SHA256
90d2c0543089913b611039f3060a59b07c75f7564246d045a8f5b3e6632c3b65

SHA512
7fa23e1f098f6473e33cda0f10f896d453d305784e6889060a9ac402d85f7af88dfae729b8c931be538ae12257d5644b67ee794b7ece7130433db6f80a594622

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39292.exe

Filesize
468KB

MD5
b1a06cf6f5c2e5e87af50a35467f687d

SHA1
3cd182193634d7dbcec39f35d7ec2e0d038ff368

SHA256
f969a9995a86833265c99f83075b41e05aea6564a9087b887bfccfc50ce334fa

SHA512
dab5779764ef5945e969d22dea5bd54b307404f0e9fe6f46cea97a8b8a3827537e78e928df7c456fa26e3e630805985a2771b226e3045cf7454f807b4cd6ad4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe

Filesize
468KB

MD5
3c4e732bae4f05fc5938f53e3301cb33

SHA1
803c99b397ea84f896a14d12a9e553edb3d00af5

SHA256
2648bcdc401a6281f76a7fbaac128a705f3e94ae9cf0e0dd18e978d1f72a0f74

SHA512
7c33969006a7d581b7659304ad5b09d884e314f35145df0079dd7df0ae140f94c97ee2e3d3050739506bc55a5973c46805a612d829ee8dd852d142eebb2cfbf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40118.exe

Filesize
468KB

MD5
8e310af211496cff28faef21b1ca4afd

SHA1
a44e2a8a8a29c665645a5df83f13c8414b8c9651

SHA256
cc2443d5d8e7d252c3cd4de5bc22eb2902a7eeeccb35cd223f9bee10a148bc3e

SHA512
062d3a9a0badb5e3aed5ab2f49d890667d45d82ca297cbdd340368ad30c1485124d06950db03c4efbe1e0fc5affea844c13307e048b600d75de42e6239285d3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42591.exe

Filesize
468KB

MD5
39989f4d21c45cb2e67910c8fffee5a2

SHA1
ca7534dc50988d9f4c398080384540fedce19bff

SHA256
536f0c4b8575c1dced78bdc7a748526883ea107fdf85a6ce98640bdb1c7d046b

SHA512
91a268a03a920f4584156f23cb98947d3e029c1b624f03cc2823202f8520a456bcfe3a137303103dc97f253fbe34739ac3c1aff63caa84b7e6b69c3ba2b8f5ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe

Filesize
468KB

MD5
cecfbe3509c04aef0808cbf36b212ea4

SHA1
28ccb8f4cedec8d4f477b1820d1d96f98360c8e7

SHA256
be6308a5729c38547bc3f34255b26890550fd37d7c42a75ce6acf894ec97c04f

SHA512
2ef9275d15361ee9ffc0102758c41df33744481df4a8c312da3edc1e68ebca3f8fb1b88327ca98d3d8299fe1af5414637dc3b0f3d67a57492b1cbdb6c0a8f404

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe

Filesize
468KB

MD5
a019064274ac632a04115862b0a5c5dd

SHA1
3c83175ae1f4dcfe326619a2993e9deaac29f033

SHA256
b36a5cc462d5c6433492c4064953d197de196f602d1bf27bab38187c852a91d7

SHA512
672cadcde786d73039a4e62acd5e757f00de19b585ebf66b1710f1a15c50da0284c74ece20ec50af05d287f2bd17c3610b7565b0e07b8495ff602167c32524b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe

Filesize
468KB

MD5
8e38c9c3d1db719ff5e424514614d6e9

SHA1
f18f8dcd025873b616950eed6ceebf4745ff11e9

SHA256
2b81b6766882004b7207e683583f018ffd45db536ab72558cf761a4e796e4c10

SHA512
b7500ddb39caa2f64226c8a1e90b6a3452c9657152eb9cd523573d40ea6c093b5d923a05b792a79cb4835bb14751588389bd7638f222d1c351260352e6bf1a35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe

Filesize
468KB

MD5
6711e8bb5ba532539ab64e5c02dd8c9b

SHA1
77fea35b7e6239134756fca85ac1d589958c96b1

SHA256
e0af246459ec9e3b8cca695cc5fd16faa2a733f9b4cd7f7be21e271dfd1ffbe0

SHA512
f51eec0840f5bf6bf308b70e141f93ff0a3e0d50c231c603c8b9040d4225df921be3aa2cc3eb7050463bb79d7e09a3a60d303eef50f729a968e13f15688568bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe

Filesize
468KB

MD5
fed5236a7eb7f2d5ce8ad6f2e4eb23cc

SHA1
aa4c5480a7ec5cb43e4591772faec9e892cb1b3a

SHA256
8386a7164615664b01c9690d702f519a3eaedbc6b6fb9b02df9c8b2a0284800c

SHA512
90b82cfc0dd13ea99fb4e3b01517db037615f39516a8529deccbfbbb32a527eca2b98472922b7c1c4be702bfe8065f424b186b416e4b692dc6a03604d30195d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe

Filesize
468KB

MD5
8402500aa8db019ef9ba876966750e0f

SHA1
53a4f0299953eff082a8400165124757083e0dd1

SHA256
0cd36f7683805086fa36cc4c8ed89e7747cc35c52035cb6c61fd7efa5bbeee31

SHA512
20583ecbfdc9757505862a533e461ac92f5ace594ad284ec8de7c4be555b94e954632bcf6ab6770e962c5818d8e28c932d1d9e67c0c6129e0b933f4ffda734ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe

Filesize
468KB

MD5
37ffefce9287e4b93a682167de6246a4

SHA1
93eaf9c3b24c060934a8542370f207ab25eb5e8c

SHA256
0ff8b4deb090283d2f9423993a6ca5f76ca3855a56768d40bd7efd6dd6a2e3b6

SHA512
0f81ce3df2453c99b2761c8c6e5673b7d7b7ca0c54af9d3f50752ff191d1fafa95f8d96f09908d2c60de8550f19a0bfb4f7f1915e8a6f9783dd427538372a179

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe

Filesize
468KB

MD5
af97a3ac4e5c2051560d6627c7d05022

SHA1
81f7bc216f80e0a00c73107f618c5d742b8eb48a

SHA256
f5895f280211ead2a001c3dac5af41e856dc3fa12dd38140124db2e1c149dd22

SHA512
fb794272c428a4e6282f7b23075cdd94684a76e9c0faadfcab0653ceed59f350ca8e9a81d73dde61366a439034e8bca1e77bd145a1e6b19e5d93bd7d93197406

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe

Filesize
468KB

MD5
e1a0271c2c86eabf01e6094bb0d1798a

SHA1
753fc8229a71f3df9024be463bf6da35be327701

SHA256
3cd9b19c42d80f4b181da874a6a763ceef80ba91311670325301530043c6b726

SHA512
24abbfc6687d582592e732fa3fc65538dc048b2523fcb95728e3988c60c9b559c8d3b103fa729910e9c05594882e3f57edf8bfa130ec82ad9bd32c17411c793d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55565.exe

Filesize
468KB

MD5
aac7560c89cb191e9f488dfa9eeee1f1

SHA1
1666c73f507842d2fcc1c0d5f647a49b7497735d

SHA256
8d4918ed3e3bb336ccda9b03eed09252508190ff856a158691910f852e887f31

SHA512
bbbda012ebce92475c2e800331e48db4873f49a752b3ab7352dc51a286b91b205ea53d47256851948729d5df6f3c1353d730e6777b93c40f9a7d940f71d7ceac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56004.exe

Filesize
468KB

MD5
62c69ed78fe8fe5b150c3ecc8a0a1836

SHA1
fc8fb849a49f9266854ae68a16af0ce542586b2f

SHA256
22d265550c6e0c83ce57d05290e7f1b24d2ce4ad42c32c119a5c9c0020cfa6d7

SHA512
f648aa4ab42bb0f17d8a2244dc02779189b52a385473211b4f44440d2ecb8c0df887a9ce6294f4b7a9ae9e93dc3f06ebe47d12d44dd2ce8526afa5d95e919a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58653.exe

Filesize
468KB

MD5
477f36176fee2eff3f93fb50a24adb4c

SHA1
0af3b06e3c20a85afb4a706d305eb64fdf2e3fbd

SHA256
58715ce51fc1c4c1e6bf8364868fccc8d8c3e219410c7fc2091c1ed031b2be5e

SHA512
fb72add17497c5d89577114c39bdfda61a852493db8e7ca9e926145ada7e04287f402aa5fae5374d858532fc61e99aa3496dac79bc7ffbc3592676630922d4ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe

Filesize
468KB

MD5
abc4831dad1264053615e0a0652e81a0

SHA1
7d392354d08c5f738aceaaa19c3a28d72ec615bd

SHA256
45b73cf74319c9f124d92b4036382ed39d70c275c82949b766f6427f86ee1251

SHA512
ca25fb9dd8d4d667355b4b5eae0b58d4ebb67a1a979814a675069a63aac25768025913bc94a8ea0ba383e93d84e27b002beac847724b4947ee15e58fac3ec77a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60921.exe

Filesize
468KB

MD5
ad95d6c6f40758ce213248901b02afc1

SHA1
43ec940d16d39bc591b905e20905dd455332fb22

SHA256
11ce4f695116e33665af22f495b3ab1218ac7f63af753e6987a5d19fd635eeff

SHA512
10ba7cbd599f99f7a2528a3b001ea456fc7c2e97a33143dd2b5c7769439aa2a5bfbed443325b2d5a84c652afc0a49e87e90747eed5add8e241e9fa78def0aad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe

Filesize
468KB

MD5
58b30c3de8295c614da7f9543d1760e3

SHA1
8d21931cbef8e4280a00aee28008612d894dd429

SHA256
234cc1bdfb4128ab189813fbec2573377d5bab6f86b3fa95fbec1aadda1431a7

SHA512
83d6e2dcc0d3288b18417fb0c6e75756d4ff2b1975fca3f8d5f54324444c92c32f512eb30ba00757b07874f1d780b6100a67463c088b446ae33695f54c2f6f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe

Filesize
468KB

MD5
1751f9096e6c94c18f93c9223552d55a

SHA1
359ceaee2e2e5c20e7fd8820fcfa895b28b2f59e

SHA256
bef04b91be1269fff21c61e7fbe5e9f8185617dd51ba8fde8c3e2d149aaa81e2

SHA512
ab34710bae54636dc7ff838749e4cbbbda5717f3705b6c777d99f2a89dc19a4dff2fe74583dc1e732f546b6784127053b261b4c62afb26f9d6aa1a5e67496bb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-671.exe

Filesize
468KB

MD5
bdf113c434e9eb5aee6174322fed800f

SHA1
b64eead8d4225063b7fe6f8b80d7d26dd41c525f

SHA256
095357eba754c7f67f9af4abb0dcf7f07648ca67a7dc13bf401f490615507868

SHA512
7da8bd9357c5732a21c9f3c4778e6ac3a4c7b27fd8b07fd44563d48f2448b8c9bfb58843316377e03f969a43be7238edd728516fbe817bbdbe7c53ec3cf67a8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7422.exe

Filesize
468KB

MD5
2a1bf1886baaa94e4510ef21910bb78c

SHA1
152e0dce0bd6bd29130a601798200cb042e83197

SHA256
61222f84606dd00ce73613e5df735b8b747c222adc18127eee214546660f2660

SHA512
d4790f8dcaef4a716149e759b5617a352f72b40cdee11ad322facf9a820f63ae93cb48b1e9b85434dc0e3fcf5069bdf7ebae54a64a5200834b9ac3367dcac9a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe

Filesize
468KB

MD5
12c6fe68efc1ef0d3ab9d37791b85c33

SHA1
50328fc397dd2a0be2d787c79dc6b6d1fd5ebc7a

SHA256
7ccdf6a96207775271177a4781bb07d7b2347e36aec17831d9572a4bdb85239c

SHA512
7394703b054d2fc1825911800b7648faf2996efe2ff83e03209ab1c1e21a480ca546a21354c3f7c0632ab5aed4ad2d8374ae635be44f98fe74ef68eff7e2b0db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe

Filesize
468KB

MD5
96a9f8ce00a79ea05a092bece93ea016

SHA1
e2539606bf353dad5de9bed1fa752c6843324b63

SHA256
645ce70e380525857431d0313286fa0628296ac7751cbc8b4ab50f30bdd61145

SHA512
011c7ffdc463901a83dfb3382a6fa958b03b2dc6b1a5ac2f00eeac8120b4caf6ec2eaeb92cf0634a3edbaf3e0abd7fdf04e4a2154331e293dc4b0a71230272bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe

Filesize
468KB

MD5
69eccdd4a78018d94d78f0242305a1bb

SHA1
f626046c721201813416a58395082d7eb46b4f47

SHA256
effb94ee2c028c61c9c0b9ba2299c67e84884fe28bcac40ed8109e08a27f37a4

SHA512
0a949f4178151aa1dc23a7985477f125956f190fe5ddc7180a5740dff4020254ef01a3d3f76fd8495cae9ba8d0bb59c7101028c3b2131ea54b017ed9c9a5b7ee

Download Submit
memory/372-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/652-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/680-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/748-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/760-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/772-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/868-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/872-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/932-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/964-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1344-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1448-30-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1472-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1572-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1752-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1920-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2184-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2464-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3152-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3176-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3272-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3448-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3480-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3632-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3764-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3968-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4052-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4216-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4244-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4392-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4448-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4604-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4648-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4812-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4832-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5068-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5156-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5276-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5296-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5380-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5444-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5556-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5572-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5596-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5676-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5696-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5748-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads