dc175b1f9c8c194f6b36ebbb305f247e806d39a5af1acfdc8640bc328364a0a0

Analysis

max time kernel
119s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9a4350e477d550abd2bf47c896f71e50N.exe
Size

468KB
MD5

9a4350e477d550abd2bf47c896f71e50
SHA1

4092019fd3da956f690f5ea0c33c09fd6ab47dba
SHA256

dc175b1f9c8c194f6b36ebbb305f247e806d39a5af1acfdc8640bc328364a0a0
SHA512

68024da11b409f3aa8bb986819991900b4b6b9e764b4772846098db790f25eba323354e3f25fa018eba7d0f1b78946f173930b119999f5d4be60c11ac2c15f1e
SSDEEP

3072:W1N+ogLday8Unb/mPz5Fff1cfGj5I8JnmHe5VisXPRioMlNuIle:W14o9LUnaP1Fff9xPPXP8xlNu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
676	Unicorn-60448.exe
3380	Unicorn-37008.exe
1732	Unicorn-8782.exe
3512	Unicorn-47392.exe
3804	Unicorn-63728.exe
3832	Unicorn-57598.exe
216	Unicorn-43863.exe
1400	Unicorn-7423.exe
1760	Unicorn-11102.exe
5084	Unicorn-6655.exe
2256	Unicorn-14823.exe
3500	Unicorn-52135.exe
728	Unicorn-333.exe
2960	Unicorn-6463.exe
1260	Unicorn-6198.exe
3508	Unicorn-3671.exe
1976	Unicorn-23878.exe
3048	Unicorn-10687.exe
3608	Unicorn-12725.exe
628	Unicorn-8967.exe
4260	Unicorn-1183.exe
1316	Unicorn-5822.exe
4708	Unicorn-49424.exe
4684	Unicorn-48470.exe
1632	Unicorn-40872.exe
4964	Unicorn-51270.exe
3636	Unicorn-57400.exe
2972	Unicorn-8510.exe
424	Unicorn-57976.exe
4728	Unicorn-21582.exe
2224	Unicorn-46440.exe
4896	Unicorn-5407.exe
4324	Unicorn-5407.exe
800	Unicorn-62776.exe
4084	Unicorn-18214.exe
1460	Unicorn-18214.exe
4536	Unicorn-56646.exe
4660	Unicorn-13886.exe
1036	Unicorn-24165.exe
804	Unicorn-38464.exe
2900	Unicorn-50503.exe
1476	Unicorn-45480.exe
4312	Unicorn-18022.exe
244	Unicorn-62584.exe
4308	Unicorn-39926.exe
2324	Unicorn-18776.exe
2364	Unicorn-58391.exe
4556	Unicorn-61728.exe
4732	Unicorn-4359.exe
1488	Unicorn-12527.exe
4540	Unicorn-830.exe
4356	Unicorn-45968.exe
1856	Unicorn-37032.exe
2904	Unicorn-12262.exe
5088	Unicorn-45968.exe
4512	Unicorn-37608.exe
5012	Unicorn-50415.exe
4228	Unicorn-64150.exe
1576	Unicorn-20310.exe
4976	Unicorn-25910.exe
2220	Unicorn-36845.exe
3968	Unicorn-47504.exe
708	Unicorn-60119.exe
4280	Unicorn-63072.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3096	15092	WerFault.exe	721
4272	2892	WerFault.exe	797

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7823.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1064	dwm.exe
Token: SeChangeNotifyPrivilege	1064	dwm.exe
Token: 33	1064	dwm.exe
Token: SeIncBasePriorityPrivilege	1064	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4064	9a4350e477d550abd2bf47c896f71e50N.exe
676	Unicorn-60448.exe
3380	Unicorn-37008.exe
1732	Unicorn-8782.exe
3512	Unicorn-47392.exe
3804	Unicorn-63728.exe
3832	Unicorn-57598.exe
216	Unicorn-43863.exe
1400	Unicorn-7423.exe
1760	Unicorn-11102.exe
5084	Unicorn-6655.exe
2256	Unicorn-14823.exe
1260	Unicorn-6198.exe
728	Unicorn-333.exe
3500	Unicorn-52135.exe
2960	Unicorn-6463.exe
1976	Unicorn-23878.exe
3508	Unicorn-3671.exe
3048	Unicorn-10687.exe
3608	Unicorn-12725.exe
628	Unicorn-8967.exe
4260	Unicorn-1183.exe
1316	Unicorn-5822.exe
4708	Unicorn-49424.exe
3636	Unicorn-57400.exe
1632	Unicorn-40872.exe
4684	Unicorn-48470.exe
2972	Unicorn-8510.exe
4964	Unicorn-51270.exe
424	Unicorn-57976.exe
4728	Unicorn-21582.exe
2224	Unicorn-46440.exe
4324	Unicorn-5407.exe
4896	Unicorn-5407.exe
4660	Unicorn-13886.exe
4084	Unicorn-18214.exe
800	Unicorn-62776.exe
1460	Unicorn-18214.exe
4536	Unicorn-56646.exe
804	Unicorn-38464.exe
1036	Unicorn-24165.exe
2900	Unicorn-50503.exe
1476	Unicorn-45480.exe
4308	Unicorn-39926.exe
244	Unicorn-62584.exe
4312	Unicorn-18022.exe
2324	Unicorn-18776.exe
2364	Unicorn-58391.exe
4556	Unicorn-61728.exe
2904	Unicorn-12262.exe
1856	Unicorn-37032.exe
4732	Unicorn-4359.exe
1488	Unicorn-12527.exe
4540	Unicorn-830.exe
5088	Unicorn-45968.exe
4356	Unicorn-45968.exe
4512	Unicorn-37608.exe
5012	Unicorn-50415.exe
4976	Unicorn-25910.exe
1576	Unicorn-20310.exe
4228	Unicorn-64150.exe
2220	Unicorn-36845.exe
3968	Unicorn-47504.exe
708	Unicorn-60119.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 676	4064	9a4350e477d550abd2bf47c896f71e50N.exe	89
PID 4064 wrote to memory of 676	4064	9a4350e477d550abd2bf47c896f71e50N.exe	89
PID 4064 wrote to memory of 676	4064	9a4350e477d550abd2bf47c896f71e50N.exe	89
PID 676 wrote to memory of 3380	676	Unicorn-60448.exe	92
PID 676 wrote to memory of 3380	676	Unicorn-60448.exe	92
PID 676 wrote to memory of 3380	676	Unicorn-60448.exe	92
PID 4064 wrote to memory of 1732	4064	9a4350e477d550abd2bf47c896f71e50N.exe	93
PID 4064 wrote to memory of 1732	4064	9a4350e477d550abd2bf47c896f71e50N.exe	93
PID 4064 wrote to memory of 1732	4064	9a4350e477d550abd2bf47c896f71e50N.exe	93
PID 3380 wrote to memory of 3512	3380	Unicorn-37008.exe	97
PID 3380 wrote to memory of 3512	3380	Unicorn-37008.exe	97
PID 3380 wrote to memory of 3512	3380	Unicorn-37008.exe	97
PID 1732 wrote to memory of 3804	1732	Unicorn-8782.exe	98
PID 1732 wrote to memory of 3804	1732	Unicorn-8782.exe	98
PID 1732 wrote to memory of 3804	1732	Unicorn-8782.exe	98
PID 4064 wrote to memory of 3832	4064	9a4350e477d550abd2bf47c896f71e50N.exe	99
PID 4064 wrote to memory of 3832	4064	9a4350e477d550abd2bf47c896f71e50N.exe	99
PID 4064 wrote to memory of 3832	4064	9a4350e477d550abd2bf47c896f71e50N.exe	99
PID 676 wrote to memory of 216	676	Unicorn-60448.exe	100
PID 676 wrote to memory of 216	676	Unicorn-60448.exe	100
PID 676 wrote to memory of 216	676	Unicorn-60448.exe	100
PID 3512 wrote to memory of 1400	3512	Unicorn-47392.exe	101
PID 3512 wrote to memory of 1400	3512	Unicorn-47392.exe	101
PID 3512 wrote to memory of 1400	3512	Unicorn-47392.exe	101
PID 3380 wrote to memory of 1760	3380	Unicorn-37008.exe	102
PID 3380 wrote to memory of 1760	3380	Unicorn-37008.exe	102
PID 3380 wrote to memory of 1760	3380	Unicorn-37008.exe	102
PID 3832 wrote to memory of 5084	3832	Unicorn-57598.exe	103
PID 3832 wrote to memory of 5084	3832	Unicorn-57598.exe	103
PID 3832 wrote to memory of 5084	3832	Unicorn-57598.exe	103
PID 216 wrote to memory of 2256	216	Unicorn-43863.exe	104
PID 216 wrote to memory of 2256	216	Unicorn-43863.exe	104
PID 216 wrote to memory of 2256	216	Unicorn-43863.exe	104
PID 1732 wrote to memory of 3500	1732	Unicorn-8782.exe	105
PID 1732 wrote to memory of 3500	1732	Unicorn-8782.exe	105
PID 1732 wrote to memory of 3500	1732	Unicorn-8782.exe	105
PID 676 wrote to memory of 728	676	Unicorn-60448.exe	108
PID 676 wrote to memory of 728	676	Unicorn-60448.exe	108
PID 676 wrote to memory of 728	676	Unicorn-60448.exe	108
PID 3804 wrote to memory of 2960	3804	Unicorn-63728.exe	106
PID 3804 wrote to memory of 2960	3804	Unicorn-63728.exe	106
PID 3804 wrote to memory of 2960	3804	Unicorn-63728.exe	106
PID 4064 wrote to memory of 1260	4064	9a4350e477d550abd2bf47c896f71e50N.exe	107
PID 4064 wrote to memory of 1260	4064	9a4350e477d550abd2bf47c896f71e50N.exe	107
PID 4064 wrote to memory of 1260	4064	9a4350e477d550abd2bf47c896f71e50N.exe	107
PID 1400 wrote to memory of 3508	1400	Unicorn-7423.exe	109
PID 1400 wrote to memory of 3508	1400	Unicorn-7423.exe	109
PID 1400 wrote to memory of 3508	1400	Unicorn-7423.exe	109
PID 3512 wrote to memory of 1976	3512	Unicorn-47392.exe	110
PID 3512 wrote to memory of 1976	3512	Unicorn-47392.exe	110
PID 3512 wrote to memory of 1976	3512	Unicorn-47392.exe	110
PID 1760 wrote to memory of 3048	1760	Unicorn-11102.exe	111
PID 1760 wrote to memory of 3048	1760	Unicorn-11102.exe	111
PID 1760 wrote to memory of 3048	1760	Unicorn-11102.exe	111
PID 3380 wrote to memory of 3608	3380	Unicorn-37008.exe	112
PID 3380 wrote to memory of 3608	3380	Unicorn-37008.exe	112
PID 3380 wrote to memory of 3608	3380	Unicorn-37008.exe	112
PID 5084 wrote to memory of 628	5084	Unicorn-6655.exe	113
PID 5084 wrote to memory of 628	5084	Unicorn-6655.exe	113
PID 5084 wrote to memory of 628	5084	Unicorn-6655.exe	113
PID 2256 wrote to memory of 4260	2256	Unicorn-14823.exe	114
PID 2256 wrote to memory of 4260	2256	Unicorn-14823.exe	114
PID 2256 wrote to memory of 4260	2256	Unicorn-14823.exe	114
PID 216 wrote to memory of 1316	216	Unicorn-43863.exe	115

C:\Users\Admin\AppData\Local\Temp\9a4350e477d550abd2bf47c896f71e50N.exe
"C:\Users\Admin\AppData\Local\Temp\9a4350e477d550abd2bf47c896f71e50N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60448.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60448.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47392.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3671.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5407.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
        8⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16664.exe
        9⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        10⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
        11⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        11⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
        11⤵
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        10⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55375.exe
        10⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        10⤵
        
        PID:15136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        10⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59751.exe
        9⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        10⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25886.exe
        10⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27015.exe
        9⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
        9⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
        9⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37062.exe
        8⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        9⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9542.exe
        9⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        9⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24477.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62536.exe
        9⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        9⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        8⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8277.exe
        8⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61096.exe
        8⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61199.exe
        8⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        8⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14671.exe
        9⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        9⤵
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14846.exe
        9⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46335.exe
        9⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
        9⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64896.exe
        9⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24133.exe
        8⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24319.exe
        8⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        8⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        8⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5015.exe
        8⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21622.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33217.exe
        7⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38376.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        8⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        9⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        9⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55752.exe
        9⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46119.exe
        8⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24133.exe
        8⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17192.exe
        8⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5750.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe
        8⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        9⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
        9⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57871.exe
        8⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        8⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
        7⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        8⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
        7⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7752.exe
        7⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49734.exe
        6⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        7⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        8⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        8⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17142.exe
        8⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30462.exe
        7⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        7⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55752.exe
        7⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45527.exe
        6⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        7⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17735.exe
        7⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19501.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe
        6⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46440.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        9⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        10⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        10⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14263.exe
        10⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        9⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17605.exe
        9⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        9⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65039.exe
        8⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33032.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52406.exe
        9⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36448.exe
        9⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51990.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        8⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
        8⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9677.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
        8⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61415.exe
        8⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13375.exe
        8⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21333.exe
        7⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        7⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60119.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13430.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29280.exe
        8⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        9⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
        9⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
        8⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
        8⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29999.exe
        7⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40766.exe
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        8⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe
        8⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33150.exe
        7⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        7⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51879.exe
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36413.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13070.exe
        6⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33217.exe
        6⤵
        
        PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56646.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31936.exe
        6⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
        8⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
        8⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18670.exe
        8⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1806.exe
        7⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2597.exe
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15728.exe
        7⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46767.exe
        6⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe
        7⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        8⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20038.exe
        8⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56703.exe
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51726.exe
        7⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13375.exe
        7⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16221.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63911.exe
        6⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        6⤵
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63767.exe
        5⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1919.exe
        7⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
        7⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
        6⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-326.exe
        6⤵
        
        PID:372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
        5⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48944.exe
        6⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26680.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
        5⤵
        
        PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11102.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5407.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        7⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        9⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49480.exe
        10⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49520.exe
        10⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
        9⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-127.exe
        9⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        8⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47207.exe
        8⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43063.exe
        8⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62734.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38800.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15214.exe
        8⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3269.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        7⤵
        
        PID:16076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe
        7⤵
        
        PID:16160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52335.exe
        6⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
        8⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        9⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2622.exe
        9⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        8⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        8⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
        7⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        7⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40855.exe
        7⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54934.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53208.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        7⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        7⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45663.exe
        7⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
        6⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exe
        6⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64800.exe
        6⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64816.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11199.exe
        8⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29894.exe
        8⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        8⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe
        8⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16040.exe
        8⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38271.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        7⤵
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32646.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe
        7⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44903.exe
        7⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7822.exe
        7⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
        6⤵
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
        6⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58801.exe
        6⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
        5⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59791.exe
        7⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        7⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        7⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30462.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57294.exe
        6⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14159.exe
        6⤵
        
        PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44375.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        6⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
        6⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40830.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        5⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe
        5⤵
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62776.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56632.exe
        6⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42896.exe
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
        8⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
        9⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
        9⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24518.exe
        9⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
        8⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        8⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
        8⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13647.exe
        8⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4263.exe
        8⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37270.exe
        7⤵
        
        PID:15724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11199.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53263.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43647.exe
        7⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13341.exe
        6⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-877.exe
        6⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        6⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60503.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8127.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39176.exe
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        7⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18653.exe
        6⤵
        
        PID:12576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
        6⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        5⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51934.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
        5⤵
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
        5⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15792.exe
        5⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
        7⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
        6⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        6⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        6⤵
        
        PID:13224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1399.exe
        6⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        5⤵
        
        PID:9532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        5⤵
        
        PID:13116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
        5⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47126.exe
      4⤵
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-167.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        6⤵
        
        PID:12916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56231.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30462.exe
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57294.exe
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        5⤵
        
        PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2838.exe
      4⤵
      PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        5⤵
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24056.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25024.exe
      4⤵
      PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
      4⤵
      PID:13740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
      4⤵
      PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14823.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23576.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        9⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        9⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43382.exe
        9⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        9⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        8⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        8⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        8⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57688.exe
        8⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        7⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54487.exe
        7⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
        7⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28214.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        8⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41664.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        7⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64392.exe
        7⤵
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22173.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24400.exe
        7⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64896.exe
        7⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49878.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
        6⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14831.exe
        6⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6423.exe
        8⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
        8⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
        8⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
        7⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38998.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
        6⤵
        
        PID:15032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39695.exe
        6⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-917.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        7⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        8⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14342.exe
        7⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        6⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8861.exe
        6⤵
        
        PID:12528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41352.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        5⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
        6⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
        6⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        5⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe
        5⤵
        
        PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5822.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62584.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7239.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
        7⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        8⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        8⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56039.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        7⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8861.exe
        7⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55384.exe
        7⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10742.exe
        6⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10279.exe
        7⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25310.exe
        7⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37382.exe
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        6⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
        6⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        7⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        7⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        6⤵
        
        PID:12568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        6⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        5⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        6⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17206.exe
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8277.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64224.exe
        5⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
        6⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        7⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe
        7⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41110.exe
        5⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3173.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43647.exe
        5⤵
        
        PID:16084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63767.exe
      4⤵
      PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        6⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
        5⤵
        
        PID:14688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        5⤵
        
        PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36861.exe
      4⤵
      PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        5⤵
        
        PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30136.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
      4⤵
      PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-333.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45112.exe
        6⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        7⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        8⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30462.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        7⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5015.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        7⤵
        
        PID:16060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
        6⤵
        
        PID:13808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        6⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        7⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        7⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        6⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        6⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
        5⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
        5⤵
        
        PID:14996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe
        6⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53720.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36655.exe
        7⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63143.exe
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43750.exe
        6⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30864.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58271.exe
        6⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46398.exe
        5⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        6⤵
        
        PID:12744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23584.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31935.exe
        5⤵
        
        PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44934.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
        5⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54296.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        6⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
      4⤵
      PID:8196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
      4⤵
      PID:11576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
      4⤵
      PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3575.exe
      4⤵
      PID:16124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8510.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46840.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51623.exe
        7⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        6⤵
        
        PID:13164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        6⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        5⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
        5⤵
        
        PID:15976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21110.exe
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
        5⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49480.exe
        6⤵
        
        PID:12588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        6⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16837.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
        5⤵
        
        PID:11836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64358.exe
      4⤵
      PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
      4⤵
      PID:15060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
      4⤵
      PID:15636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36845.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
      4⤵
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37448.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24341.exe
        5⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
        5⤵
        
        PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
      4⤵
      PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29999.exe
      4⤵
      PID:11572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49553.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22910.exe
    3⤵
    PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        5⤵
        
        PID:13364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        5⤵
        
        PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
      4⤵
      PID:14292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
      4⤵
      PID:15680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
    3⤵
    PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49480.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20990.exe
      4⤵
      PID:15660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
      4⤵
      PID:7240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64702.exe
    3⤵
    PID:10220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32294.exe
    3⤵
    PID:15172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41495.exe
    3⤵
    PID:7964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8782.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8782.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37608.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29280.exe
        8⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52671.exe
        8⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
        8⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 80
        9⤵
        Program crash
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29999.exe
        7⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-352.exe
        7⤵
        
        PID:7984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe
        6⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        8⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        8⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe
        8⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        7⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37398.exe
        7⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13813.exe
        6⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26270.exe
        7⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        6⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8277.exe
        6⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe
        6⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25910.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        6⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42864.exe
        8⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28767.exe
        8⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        7⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        7⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        7⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63974.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29605.exe
        6⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
        6⤵
        
        PID:15788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
        5⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46494.exe
        5⤵
        
        PID:11632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51096.exe
        5⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34479.exe
        5⤵
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21582.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12527.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
        6⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe
        8⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52671.exe
        8⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32125.exe
        8⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41735.exe
        8⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        7⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
        7⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        7⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
        6⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57072.exe
        7⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        7⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        6⤵
        
        PID:11172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9542.exe
        6⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13662.exe
        6⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36294.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47871.exe
        7⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        6⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63152.exe
        6⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        5⤵
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        5⤵
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        5⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
        5⤵
        
        PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
        6⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20576.exe
        7⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        7⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        6⤵
        
        PID:15012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65359.exe
        6⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63799.exe
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe
        5⤵
        
        PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
      4⤵
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46968.exe
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55479.exe
        6⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48167.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54783.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        5⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54223.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5149.exe
      4⤵
      PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9567.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9878.exe
      4⤵
      PID:10092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
      4⤵
      PID:14288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34479.exe
      4⤵
      PID:15916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57400.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        6⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21672.exe
        7⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28552.exe
        8⤵
        
        PID:16104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63480.exe
        8⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        7⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
        7⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5277.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34606.exe
        6⤵
        
        PID:15500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
        5⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        6⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        7⤵
        
        PID:16180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17735.exe
        7⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54591.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27413.exe
        6⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe
        6⤵
        
        PID:15456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        6⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7949.exe
        5⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        6⤵
        
        PID:14040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        6⤵
        
        PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        5⤵
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        5⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49553.exe
        5⤵
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50415.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
        6⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1919.exe
        7⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        7⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23661.exe
        6⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63798.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6734.exe
        5⤵
        
        PID:11088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53606.exe
        5⤵
        
        PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe
        5⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
      4⤵
      PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
      4⤵
      PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25862.exe
      4⤵
      PID:15632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21535.exe
      4⤵
      PID:1276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        7⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        6⤵
        
        PID:13484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        6⤵
        
        PID:15948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        5⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
        5⤵
        
        PID:15244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39695.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51671.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14671.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14253.exe
        6⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60831.exe
        5⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65358.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13567.exe
        5⤵
        
        PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38510.exe
      4⤵
      PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26824.exe
        5⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        5⤵
        
        PID:15896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        5⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8277.exe
      4⤵
      PID:13104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2086.exe
      4⤵
      PID:14428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12262.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
      4⤵
      PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53208.exe
        5⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        5⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31335.exe
        5⤵
        
        PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29999.exe
      4⤵
      PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41577.exe
      4⤵
      PID:7972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
    3⤵
    PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
      4⤵
      PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
      4⤵
      PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
      4⤵
      PID:13348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22510.exe
      4⤵
      PID:16180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
    3⤵
    PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
      4⤵
      PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55479.exe
      4⤵
      PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe
      4⤵
      PID:16300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25024.exe
    3⤵
    PID:10024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
    3⤵
    PID:13968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
    3⤵
    PID:15732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52471.exe
    3⤵
    PID:3880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57598.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57598.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        6⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        7⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11077.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57062.exe
        6⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16424.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15887.exe
        7⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59310.exe
        6⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        6⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35998.exe
        5⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        7⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62967.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        6⤵
        
        PID:13184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        6⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22173.exe
        5⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32480.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61071.exe
        6⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16054.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe
        5⤵
        
        PID:14680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        5⤵
        
        PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7239.exe
        5⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        7⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        7⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27704.exe
        7⤵
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        6⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-127.exe
        6⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        5⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        5⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31527.exe
        5⤵
        
        PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64639.exe
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57536.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        6⤵
        
        PID:12848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65359.exe
        6⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
        5⤵
        
        PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        5⤵
        
        PID:14216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        5⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
        5⤵
        
        PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21677.exe
      4⤵
      PID:7488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18046.exe
      4⤵
      PID:10140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
      4⤵
      PID:14456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
      4⤵
      PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56056.exe
      4⤵
      PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        5⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52671.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        6⤵
        
        PID:15700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63920.exe
        5⤵
        
        PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
      4⤵
      PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
      4⤵
      PID:11200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
      4⤵
      PID:15092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15092 -s 436
        5⤵
        Program crash
        
        PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24511.exe
      4⤵
      PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
    3⤵
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
      4⤵
      PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        5⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        5⤵
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16463.exe
        5⤵
        
        PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
      4⤵
      PID:8240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47207.exe
      4⤵
      PID:12600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21749.exe
      4⤵
      PID:16372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32991.exe
      4⤵
      PID:8788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
    3⤵
    PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
      4⤵
      PID:11900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
      4⤵
      PID:16756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe
    3⤵
    PID:9948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8807.exe
    3⤵
    PID:13636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25126.exe
    3⤵
    PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
    3⤵
    PID:15728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6198.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6198.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21184.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
        6⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62759.exe
        6⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        6⤵
        
        PID:13816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6750.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
        5⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        6⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        5⤵
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59502.exe
        5⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe
        5⤵
        
        PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34566.exe
      4⤵
      PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-78.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-78.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24734.exe
        6⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11341.exe
        5⤵
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        5⤵
        
        PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54270.exe
      4⤵
      PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
      4⤵
      PID:9892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8277.exe
      4⤵
      PID:12860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
      4⤵
      PID:2888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58391.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
        5⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        6⤵
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        5⤵
        
        PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
      4⤵
      PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
        5⤵
        
        PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
      4⤵
      PID:11216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
      4⤵
      PID:692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
      4⤵
      PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
    3⤵
    PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
      4⤵
      PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55024.exe
        5⤵
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52095.exe
        5⤵
        
        PID:11612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe
        5⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5015.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35646.exe
      4⤵
      PID:8896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40278.exe
      4⤵
      PID:11492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9600.exe
      4⤵
      PID:1180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13814.exe
    3⤵
    PID:7528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5999.exe
      4⤵
      PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        5⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36616.exe
        6⤵
        
        PID:15356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21559.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48063.exe
        5⤵
        
        PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10742.exe
      4⤵
      PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48520.exe
        5⤵
        
        PID:12864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36366.exe
        5⤵
        
        PID:15940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30216.exe
        5⤵
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38271.exe
      4⤵
      PID:14828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
    3⤵
    PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        5⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        5⤵
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
      4⤵
      PID:9444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
      4⤵
      PID:14192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
      4⤵
      PID:2604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
    3⤵
    PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
      4⤵
      PID:9092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
      4⤵
      PID:13340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33496.exe
      4⤵
      PID:1480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18358.exe
    3⤵
    PID:10212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16253.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38489.exe
    3⤵
    PID:1648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20310.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20310.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe
    3⤵
    PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
      4⤵
      PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54768.exe
        5⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        5⤵
        
        PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
      4⤵
      PID:15044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
      4⤵
      PID:15512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
    3⤵
    PID:7776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
    3⤵
    PID:11240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
    3⤵
    PID:15988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35614.exe
    3⤵
    PID:15992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
  2⤵
  PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe
    3⤵
    PID:7944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
    3⤵
    PID:11112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32597.exe
    3⤵
    PID:15192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
    3⤵
    PID:1088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35181.exe
  2⤵
  PID:8396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
  2⤵
  PID:11592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:15716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3663.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3663.exe
  2⤵
  PID:7640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:4884

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe

Filesize
468KB

MD5
06d25a64591220f36e35eb949e6d4724

SHA1
1a203278349bc00e78aaaeee2e9043f1897750f7

SHA256
9ef62ee7a8a1d61cc94bae32c4df0f7794e70e2e05f8f0d3c494ce7fd9b8d507

SHA512
da55dcaa46f6b2ca705247c70da465faf3aee47835e84efe237986f55d84c9d9b25e69708f91d1df160f9dbeaf2f9ff50a2207878c34841db07cc655a7f76b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11102.exe

Filesize
468KB

MD5
78ce87367c0f6d7f34e2a2920fddd896

SHA1
cf49deeb8aa65f8450e0f4fec310d4d3e080b7a6

SHA256
ec83c18bf1c0d185f8f1d3cb03c2e12d4a8c32cbf8a4bc1cf04001306a5011f1

SHA512
c68599151f76a68472a421d085df6c151132d60162679b3940700ff35a8a3f601f8eea456efbe029fd75aa1eeb58f68417b4fbf59a956e7423156260ca27ea97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe

Filesize
468KB

MD5
980052327d9523ba55dce41344ca862e

SHA1
16e41664ce493dd2c0f8da7c3dc29b094d27c6fd

SHA256
cbe2769fdb7e5db32d3f9ff630f0088c806d1ade939c935c9190af23bf20bec4

SHA512
660564cac4b6b554cf7c90b51ab57c0372ba1c957c96a676c122ea4a4e2a95a17bf7ec9f99f7ba57c7a9302a83b587952d07aa05273857318bb5e87eb4ac0654

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe

Filesize
468KB

MD5
cc39c19a7195dab3f2320019aa2f1ea7

SHA1
eddc81d47abcbf0181e5fddd31bec2eb6f205fd3

SHA256
1e27ddb739431f381654b4aadb62d2c7c6b6a511a9b2684afdf91ac0247fcd3d

SHA512
860de0fd27c8935bcb94c3b46cb90854b959b0252314cbd1f13367c32dc46350c0fec9e49f578cdc8fd4ced92861b70ec7125d76e84d2632a76025e4ab06858d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14823.exe

Filesize
468KB

MD5
82f8200341753909b427596fe4714864

SHA1
3c89d93216cd16a8150769f07967b65d6bd81c42

SHA256
48cd2020fc84c5883693afc9186b185146da4853ab020e9e47bd55477c0e2fde

SHA512
fd9870b14ed3b6c3ed6cf7534165296f3dc83d505c1a4acb130c7eee5462170a57978867fc2af4f6266ec457ea11b9047d079bccae78febce7f0c3d28917f634

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21582.exe

Filesize
468KB

MD5
d6f59a99391959f2470469835dcc7b82

SHA1
b195392ffcca71d50876e273024449744a435df1

SHA256
17418565e71882e8780ad80e2ee32f3803567b468823a7ed4b2f737c0d455f99

SHA512
b367dbc6c6ae5c4cb89d69c07b4e6ffa80a11189771ef4e07aa267e2d5bae4bea362d126741326e419066d3dccb06033a198a724c6c29bc5439a34347ecf6d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe

Filesize
468KB

MD5
e28fbcd1e7c7197faf95a0a44dd53761

SHA1
c91447291ae747d601626284b25387d833505bb7

SHA256
8007abc1e9c380c6624e659d5344c43b7205f6f448c517521202d3b5d34bc9c2

SHA512
d3ca6c41569752368608ea3eaadb3258e5da3b27659a701a914336664f2edb887a5c2e7925026602afd61a14e414a7461a0d2ad40d8b5ab36cef9509db6ce79a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-333.exe

Filesize
468KB

MD5
c5979d0f6c0d6622055c5c5b40d95527

SHA1
7b3fdd376619521a07e1ec1b195dc29377b96a58

SHA256
a793c401f7cdb0e880aef9e0be2b136d5a2125625c6d51629d6457b2b8eb93fd

SHA512
bf57f91dd5b1ed645a3da7f696ad150ca1c4bf68c748bd8d369acd7048a4bdb88170c50816df483d1b35d70a1e9ce514bba2f951993c7ade81567e24904082d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3671.exe

Filesize
468KB

MD5
73eaad3483e7b6e829362e404d31ebc4

SHA1
3201c41b15849fdb0eb3993f6830cff58a706c66

SHA256
d1d6d79d3505952bccf2724245743cd8acce1a07057deefd2bcafc94441d6359

SHA512
5b99a249c95b429942f344cb72b25c30b82e5c513899563a66c8e220b34f2ba494bae84abcb78247d12753cd5e5aba0ba4ee40631ecede051116f727ded45b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exe

Filesize
468KB

MD5
4222cd01d16482b99a1698e7ef2c8f6f

SHA1
3156ab57f20444935d714e44854a66a405eac8bf

SHA256
72f0aa3f4915978cad80e7d220331a41bbd930ccdffe7b96c47753b9aadbd75f

SHA512
7342c0fa664a5e73703a6355e9bc975b9d62d94987761c636e1ac78e83ea07e4861d505612855336d3a46f2b005f2f096e3ee5de2899e0fcf65dbc55605ca933

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe

Filesize
468KB

MD5
3468b7813f2de87b162ba7c2a31b2fc4

SHA1
83b9476da139809f4c9263b4ff475adfe43de280

SHA256
7915cd4afa11ef067e2d2d8817079a6eca16e999b86a815982577d2668a84b7f

SHA512
52971eba08404f274792447bf1e864f352bb5ab7b1bb625f2726449bfc5608cb6ac0f1e0327d29e1c725eb0da06b51cece8665ae0361a47d664bfda85a4670b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe

Filesize
468KB

MD5
81c3f50b62da1f8a0b2275726e577755

SHA1
e0bd0e23abcb7515bbdf9920a8b6325b17182bc0

SHA256
9f1d7aa0ea8c18556c075064655df3ad37689511759512f9f3744be383e4a1ad

SHA512
8912f69432f0e7ce6b3201b2309b79dfe77508891f45778159205f553247c52d0dfc438c1587883fbfaf228723b2cdb9d72a11bbcc6d2791c2bdb8619e9d2d39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46440.exe

Filesize
468KB

MD5
462ff8ad2b00badb0e8d771beebccc30

SHA1
88b01e91b9cb4b87f0a4e3de7ce991758fc8e1a0

SHA256
a3eb7cc7e8f3bd2e498c5dd4ce03f73e5c8e5d50aa3a8a70c59a38f2d9d11d99

SHA512
6c58da06331d9038c1f70ba3cc68b751e83549ad67e15fb99f1947e920bd15a9ac6a61e15319f281517c08a8263cad9d2895f09958450ca0fa954587d65e235e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47392.exe

Filesize
468KB

MD5
a317d9fd7d2082157368940efd64c3ba

SHA1
f64d143c93b553e209a3dbf8237c725a93c103d0

SHA256
7dbdfd164de40be1d02c58a42c7e8823fbd6b2b22164c1c88f7879fb06b00614

SHA512
530969e6ba43fc883ae14aa3c4feb92aa3074846dbd0606fe8abd1b8d5939ae9f3b2494fd9c1a16285e1b1da5d248824c583c266b8e5949aff1e36830062a793

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe

Filesize
468KB

MD5
bf38931d2f1dba7ef753a444bca6d818

SHA1
a46b54ec9d989f43837c6b4559a93c7487981841

SHA256
910a92f34e59f9a455cbb3b7bca5279fd65e426fb05a8c07b6588573a7df82e1

SHA512
24d33b7b005f11d54fc596f7f06d510beef5f7dea7176c544f49cbab7ac8a4c928a8ca10097738ae701666471d4f284200690f64d7bff8f7075c2ed8b9f65589

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe

Filesize
468KB

MD5
7818c82c9ef3047b50b2214ee0b06013

SHA1
869a1ae4aff2fa7b00d98b47bad036c5e2bd0ef9

SHA256
a1bccfeed72ef509c18ca807a4b8a2bfc5e9baa2728b627525f615ef9e8bad57

SHA512
1f2381dfd8ecc153cdeaf627d5bf4bbdaba02b4c5052d805d6c8018986b7c95a7484ce2b88f267f55c368b25796a785ffd588aa30e83b99d932521615fd5c6d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe

Filesize
468KB

MD5
f142cba11046e287c5fcb0906ef827cf

SHA1
b04faeb9b13fa1f130823a4bc82d40927da183a5

SHA256
befcdc099b4e12fb3daa0417fa91046b5d64de17c70c386133a62d7d0bc1d4d9

SHA512
b2d2facedfcb356ee0c0271339e48bdab8cb4bb22e8cca493decbbd47a33095f39d216e3738918e52a5167225877fbbf0360401f31fe65649da81b25c1a70e9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exe

Filesize
468KB

MD5
00371ee3559a4d4f6e8191ed84d073e5

SHA1
532e1a8903a72245698154eeecbbd5f3efa00c68

SHA256
9f21b2af0fcf2e59773332dc1406d1b12d22acfadddd7253150c9c2515e86dd0

SHA512
eccb2b3aff28416d2b6c747c5a79d2949342c27a8eeab4a30eeb9fc1b15cea918ad0515bab54857fbce426a350a01da691526fd3a73ca9b998eebc7ffcbac91c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe

Filesize
468KB

MD5
c5d275bec208a571b5b75f5a79ef7a5e

SHA1
51fe0e9e6b5f96d1857ae9a8cba7c967afc78074

SHA256
94f04b3d0dfaa2fb731180b90ba32ea8a903a2a9562d36db22ffb72551f353dd

SHA512
273495da91e3629f1ada755e5fec23fac40f5790b7e40a5a513a0b9d0762312da3978402223ed95ea88415291b9685607abcef23edfa1f03907b099c57f615e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5407.exe

Filesize
468KB

MD5
a84da05a6c455aeca23aa29393c32d80

SHA1
2e2c5093ca80c7f3a513ef32a087d958b6d2a39a

SHA256
c61a1e681c5302c2a50e1cc69a2aefe5429a91862604614a0b59adfef7b0d32a

SHA512
5073ccbbd822638312eb5a6d8aa570f99bce9b621ad42d0f450f9cd3caf1dc62edf1f3e28c2340f4701ec33a585665cd357165ee2c8841a83ccb4455515065dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57400.exe

Filesize
468KB

MD5
9412eb7a58099095461c636a322c56a0

SHA1
913a33821f0d2c843e130074d45c0fd861bc8697

SHA256
2c698dd9a1c369d76d1fdb3939e8d74f10636979725abe8fbeb46be1fb6b3658

SHA512
1152e3bf598450a8d1dc9ea0a48fb0f00edc97f613e2bc665619c8039444097f72eb97500f6a554e41f8ec31086586774fd407bb2937ee45cfac85a80b0ec23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57598.exe

Filesize
468KB

MD5
af3c4b6c49de71b789583ef91be33db6

SHA1
42b297d9beff2e62cfacb16b6ada5486b31eebcb

SHA256
88fa8102a4dcb1c0f6923a7574d51ed4e784b60260bb7881c72879b22d1ff143

SHA512
db2b68e58db60b5787ba8651e9687666e3374d8099b66238a820929283d8ce83b1cc44172603e02ecdf3f105c6233c1d739e1d56b31dcf5dda02bdd0d90aec0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe

Filesize
468KB

MD5
c6418b2b9cf98aed04fabaa01924daa1

SHA1
7fa0c6e02189c5955341efef6e3d420a83a43165

SHA256
2ede7c91a3b6402e4bbc0bfd4378ef2a26d0c6297ddbdffb442e93ccf6b35cc9

SHA512
ca928edfb567b01907a65eb413e2be567ce8a73c6f3ff61f980aca94f882de025c9260d312ca51e50443303b30141897dffa9db6888f6b7c87c18b149eb849bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5822.exe

Filesize
468KB

MD5
016d7d47b69d0356f98ff9af3899c5cf

SHA1
a41d0523bd2360284af6cd943cf6b3e26dc45756

SHA256
4255670bf338048dfb645c8838ceec4be44c52ef6aa375cd01cda86fecefa525

SHA512
b41c9b4bfc70c1b0f74003576687deb30870b69cf9f74a7bd0efed388b7d30cfabeb9ce20f8c667e5dafa6420c450508c592646d5d81c38d6e08a3d2d2309b6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60448.exe

Filesize
468KB

MD5
ac264f39527d63f26cb22ef45a4222ab

SHA1
5b4c9a46c47f100936d39c08525b6eedb3030277

SHA256
3f6a53723c88899133d12bb48920f4af8328d3cc9aa6dcf66a0c30f8be8b19c5

SHA512
65de6dd9e9e509d428717a66b96bdc3f65ff86134a85063085afeedc0e585b8f5adac1634349baacabea2aa619cea1051c0fce807f562ac4b04a1dc3cb9a6495

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6198.exe

Filesize
468KB

MD5
157dfd4e4a996898b527270a5ef527bd

SHA1
e0a591bc49a4eaf3b7708b6c8bcc8077f4bb3ba9

SHA256
05861ed274607812fcc59d706850304a0a35e4c7f4fd60b930d4d882614f7563

SHA512
ecdf2c8f0f7f912ef7d568d3532f95c4dc3cbc6e17c5013b1ff56d155edd812bcd6a1985f8c74b02daa2a164b80b030cb6e63b58052985ae420594b7637c078c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe

Filesize
468KB

MD5
9b9dd8a7788803b0acc1e28dd4fcf299

SHA1
c88024d1f24119ab0988142438ea6f6e47ccaabd

SHA256
80dc87769e954aa6ede4f35e48c3b35fd86165220e97ed27efd28d76d553d800

SHA512
4300ca25ad7c0c930098c61f98bd19cad82ac36a61f7b30cfe03143a176ddd4b8fffd7ffd6dc7b763b4b152a4fffb44b4cd572baff10e130b8097a58f2747256

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe

Filesize
468KB

MD5
039e30d1eec36eec7377c375dd44695a

SHA1
1451a7344af4beabfe6cd10a85ec4e74e2d716e7

SHA256
9c8d4306113d63231bec220ad3b18a143feec7883ce2eeb1e6ae41676decaff0

SHA512
63c86b98eb091fcf42da810a5ecb88f9ce71618601b42cad3d32c4479cbef4564cb530249a2860a0f9a004efe8c37c32a7cd4e9675b3fac49597700019f6cbc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe

Filesize
468KB

MD5
9d510cc8043f555475ac07f802bc71c8

SHA1
0ca8f517321f9b9073e3a031804aba3dd1936f92

SHA256
1e6842919a53e5cae49739f9a48507edcdb297cd21ac31477cfec56ed200cfec

SHA512
617a1b437dbe155a5f9a5f62416fa4c88a9f3e416f6d3e0a0147f9b7a1433f80e289e18121bc6a16f6dd98de08e94c92f124e778bdc1062ffe450ae82fc10f40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe

Filesize
468KB

MD5
a646bb9de1d313df037aea91198b5cce

SHA1
155b53ef070a9580743f1186b56eb7bd4d03fd22

SHA256
7d26225302104aa38922be39bfd0d262e4b345c75f40d293f0ce26289b45d7e5

SHA512
97604cb1cfe45592b02ab4da7f8542a33b22995143d01a22216e6ee6b15336a930312e1ee5f1ce980763985cf87305643251fa84671baae653d82f33f6f586ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8510.exe

Filesize
468KB

MD5
854131d92707d0d280e927601ab2b1ff

SHA1
c4decfc839090c9b8b31ac871d9e75086fe7f8b3

SHA256
aab47f11945aac11c3899aa8d36bd580d817ede6ba20ff903b77cd88bd1ab3d5

SHA512
474a8210d3c67ff39a41c8b357868ba10db6a9f2043928b49c4aa1d73c8c7388573f703ff511562518e41a41533739d5318cc13be9fbea9ebb3e28bd72d7f7a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8782.exe

Filesize
468KB

MD5
7690672f23473bf73f4ae36bfa3507c9

SHA1
e55a4b42e942b260c01d5df98da651be45d90d5d

SHA256
c7b84be0244957f0f3096b5c25f9afc317e767b1b4a89aade5333c7b81ca045b

SHA512
60b2f2b4cb9c3d7a1529d2aa0fa32539bb3535f4e7eb6889eeb8592ca5c10e27192474e0afffcf15c3d477eb58651d3d3f4ee094c63b351246bbeb27b67b900a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe

Filesize
468KB

MD5
5534a79463719aa0d038dd1f8766bba3

SHA1
e6545f2762b6621b0bb9391961b719354dbd8614

SHA256
859d1d90883db5c087b54ef535f4a59448815de0ea024b88382fcd7a999496b6

SHA512
5f86afa0419c7393277e1a212f8f2ccde9745535947d591c898ed4c923e4cb8e236902c8593ea3b6f340038874b02ceee78b7237e802cb955642d6e411901290

Download Submit
memory/116-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/216-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/244-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/608-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/628-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/676-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/708-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/728-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/800-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/804-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/960-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1036-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1136-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1148-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1248-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1260-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1316-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1476-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1540-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1576-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1904-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3048-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3380-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3500-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3508-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3512-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3636-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3804-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3832-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3928-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3968-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4084-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4228-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-2855-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4556-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4660-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4684-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4708-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4728-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4976-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5144-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5160-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5192-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5512-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5528-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5640-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5684-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5764-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5780-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5804-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15524-2856-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15660-2416-0x00007FF802120000-0x00007FF8021A3000-memory.dmp

Filesize
524KB

Download
memory/15732-2847-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads