faf56a66625db075480201be8ea4e3a2e6344723ed92de477d7d360b635b9c1a

Analysis

max time kernel
119s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1838ac21a2a5f428f0d26c25eab0830N.exe
Size

468KB
MD5

f1838ac21a2a5f428f0d26c25eab0830
SHA1

b392d826e9df774d6d3763b939fb5c6e0fbe154a
SHA256

faf56a66625db075480201be8ea4e3a2e6344723ed92de477d7d360b635b9c1a
SHA512

70ff56028e07c1c3746bcf3211dd2fed463e14a3129bddc2420cc71bd3f2312f5258a10b71a4b7cef20fd043e1198bfceca894adcdf00029d8d050b68ef5713e
SSDEEP

3072:HbYZogHOP08UAaYFPziFff8/AChA/4peBdH5ZVaU6w73mIzcuSab:Hbeo35UAtPeFff9EMn6wj/zcu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4704	Unicorn-38821.exe
3176	Unicorn-21774.exe
3456	Unicorn-25535.exe
2228	Unicorn-43777.exe
1784	Unicorn-24125.exe
2196	Unicorn-17994.exe
2320	Unicorn-49376.exe
632	Unicorn-38489.exe
232	Unicorn-26237.exe
1960	Unicorn-26237.exe
732	Unicorn-6371.exe
2748	Unicorn-26237.exe
4876	Unicorn-34140.exe
4480	Unicorn-28274.exe
4684	Unicorn-14539.exe
432	Unicorn-12744.exe
4920	Unicorn-51317.exe
4536	Unicorn-17021.exe
224	Unicorn-62137.exe
1524	Unicorn-17767.exe
408	Unicorn-58857.exe
2068	Unicorn-59122.exe
3304	Unicorn-43231.exe
3280	Unicorn-63097.exe
2172	Unicorn-12919.exe
1860	Unicorn-19050.exe
4324	Unicorn-19050.exe
1412	Unicorn-37830.exe
2980	Unicorn-30979.exe
3684	Unicorn-40631.exe
3548	Unicorn-64996.exe
4416	Unicorn-19325.exe
376	Unicorn-21908.exe
1988	Unicorn-41966.exe
740	Unicorn-41966.exe
1108	Unicorn-21546.exe
976	Unicorn-34958.exe
3112	Unicorn-33497.exe
4428	Unicorn-43288.exe
3012	Unicorn-43288.exe
4444	Unicorn-37880.exe
1972	Unicorn-42158.exe
2724	Unicorn-3355.exe
3136	Unicorn-21930.exe
3732	Unicorn-61893.exe
2520	Unicorn-54529.exe
1720	Unicorn-62962.exe
1940	Unicorn-11570.exe
5016	Unicorn-17701.exe
1920	Unicorn-51312.exe
4884	Unicorn-5640.exe
4284	Unicorn-5640.exe
3688	Unicorn-5640.exe
4368	Unicorn-63564.exe
1792	Unicorn-45911.exe
4436	Unicorn-54841.exe
2440	Unicorn-22723.exe
1180	Unicorn-57948.exe
724	Unicorn-44213.exe
836	Unicorn-63813.exe
3040	Unicorn-9724.exe
936	Unicorn-30913.exe
2860	Unicorn-25851.exe
1044	Unicorn-31982.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
15472	14264	WerFault.exe	703
16268	11932	WerFault.exe	706

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34437.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	14612	dwm.exe
Token: SeChangeNotifyPrivilege	14612	dwm.exe
Token: 33	14612	dwm.exe
Token: SeIncBasePriorityPrivilege	14612	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4060	f1838ac21a2a5f428f0d26c25eab0830N.exe
4704	Unicorn-38821.exe
3176	Unicorn-21774.exe
3456	Unicorn-25535.exe
2228	Unicorn-43777.exe
1784	Unicorn-24125.exe
2196	Unicorn-17994.exe
2320	Unicorn-49376.exe
632	Unicorn-38489.exe
4480	Unicorn-28274.exe
4684	Unicorn-14539.exe
2748	Unicorn-26237.exe
232	Unicorn-26237.exe
4876	Unicorn-34140.exe
732	Unicorn-6371.exe
1960	Unicorn-26237.exe
432	Unicorn-12744.exe
4920	Unicorn-51317.exe
224	Unicorn-62137.exe
4536	Unicorn-17021.exe
2980	Unicorn-30979.exe
1412	Unicorn-37830.exe
1860	Unicorn-19050.exe
1524	Unicorn-17767.exe
2172	Unicorn-12919.exe
408	Unicorn-58857.exe
3280	Unicorn-63097.exe
2068	Unicorn-59122.exe
3304	Unicorn-43231.exe
4324	Unicorn-19050.exe
3684	Unicorn-40631.exe
3548	Unicorn-64996.exe
4416	Unicorn-19325.exe
376	Unicorn-21908.exe
1108	Unicorn-21546.exe
740	Unicorn-41966.exe
1988	Unicorn-41966.exe
976	Unicorn-34958.exe
3112	Unicorn-33497.exe
4428	Unicorn-43288.exe
3012	Unicorn-43288.exe
1972	Unicorn-42158.exe
4444	Unicorn-37880.exe
2724	Unicorn-3355.exe
3136	Unicorn-21930.exe
1720	Unicorn-62962.exe
3732	Unicorn-61893.exe
2520	Unicorn-54529.exe
1940	Unicorn-11570.exe
5016	Unicorn-17701.exe
1920	Unicorn-51312.exe
4436	Unicorn-54841.exe
1180	Unicorn-57948.exe
4884	Unicorn-5640.exe
2440	Unicorn-22723.exe
724	Unicorn-44213.exe
4368	Unicorn-63564.exe
836	Unicorn-63813.exe
4284	Unicorn-5640.exe
3688	Unicorn-5640.exe
1792	Unicorn-45911.exe
3040	Unicorn-9724.exe
3892	Unicorn-19730.exe
1044	Unicorn-31982.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4704	4060	f1838ac21a2a5f428f0d26c25eab0830N.exe	87
PID 4060 wrote to memory of 4704	4060	f1838ac21a2a5f428f0d26c25eab0830N.exe	87
PID 4060 wrote to memory of 4704	4060	f1838ac21a2a5f428f0d26c25eab0830N.exe	87
PID 4704 wrote to memory of 3176	4704	Unicorn-38821.exe	92
PID 4704 wrote to memory of 3176	4704	Unicorn-38821.exe	92
PID 4704 wrote to memory of 3176	4704	Unicorn-38821.exe	92
PID 4060 wrote to memory of 3456	4060	f1838ac21a2a5f428f0d26c25eab0830N.exe	93
PID 4060 wrote to memory of 3456	4060	f1838ac21a2a5f428f0d26c25eab0830N.exe	93
PID 4060 wrote to memory of 3456	4060	f1838ac21a2a5f428f0d26c25eab0830N.exe	93
PID 3456 wrote to memory of 2228	3456	Unicorn-25535.exe	95
PID 3456 wrote to memory of 2228	3456	Unicorn-25535.exe	95
PID 3456 wrote to memory of 2228	3456	Unicorn-25535.exe	95
PID 4060 wrote to memory of 2196	4060	f1838ac21a2a5f428f0d26c25eab0830N.exe	96
PID 4060 wrote to memory of 2196	4060	f1838ac21a2a5f428f0d26c25eab0830N.exe	96
PID 4060 wrote to memory of 2196	4060	f1838ac21a2a5f428f0d26c25eab0830N.exe	96
PID 3176 wrote to memory of 1784	3176	Unicorn-21774.exe	97
PID 3176 wrote to memory of 1784	3176	Unicorn-21774.exe	97
PID 3176 wrote to memory of 1784	3176	Unicorn-21774.exe	97
PID 4704 wrote to memory of 2320	4704	Unicorn-38821.exe	98
PID 4704 wrote to memory of 2320	4704	Unicorn-38821.exe	98
PID 4704 wrote to memory of 2320	4704	Unicorn-38821.exe	98
PID 2228 wrote to memory of 632	2228	Unicorn-43777.exe	101
PID 2228 wrote to memory of 632	2228	Unicorn-43777.exe	101
PID 2228 wrote to memory of 632	2228	Unicorn-43777.exe	101
PID 3456 wrote to memory of 732	3456	Unicorn-25535.exe	102
PID 3456 wrote to memory of 732	3456	Unicorn-25535.exe	102
PID 3456 wrote to memory of 732	3456	Unicorn-25535.exe	102
PID 2196 wrote to memory of 1960	2196	Unicorn-17994.exe	104
PID 2196 wrote to memory of 1960	2196	Unicorn-17994.exe	104
PID 2196 wrote to memory of 1960	2196	Unicorn-17994.exe	104
PID 2320 wrote to memory of 232	2320	Unicorn-49376.exe	103
PID 2320 wrote to memory of 232	2320	Unicorn-49376.exe	103
PID 2320 wrote to memory of 232	2320	Unicorn-49376.exe	103
PID 1784 wrote to memory of 2748	1784	Unicorn-24125.exe	105
PID 1784 wrote to memory of 2748	1784	Unicorn-24125.exe	105
PID 1784 wrote to memory of 2748	1784	Unicorn-24125.exe	105
PID 4060 wrote to memory of 4876	4060	f1838ac21a2a5f428f0d26c25eab0830N.exe	107
PID 4060 wrote to memory of 4876	4060	f1838ac21a2a5f428f0d26c25eab0830N.exe	107
PID 4060 wrote to memory of 4876	4060	f1838ac21a2a5f428f0d26c25eab0830N.exe	107
PID 4704 wrote to memory of 4480	4704	Unicorn-38821.exe	106
PID 4704 wrote to memory of 4480	4704	Unicorn-38821.exe	106
PID 4704 wrote to memory of 4480	4704	Unicorn-38821.exe	106
PID 3176 wrote to memory of 4684	3176	Unicorn-21774.exe	108
PID 3176 wrote to memory of 4684	3176	Unicorn-21774.exe	108
PID 3176 wrote to memory of 4684	3176	Unicorn-21774.exe	108
PID 632 wrote to memory of 432	632	Unicorn-38489.exe	109
PID 632 wrote to memory of 432	632	Unicorn-38489.exe	109
PID 632 wrote to memory of 432	632	Unicorn-38489.exe	109
PID 2228 wrote to memory of 4920	2228	Unicorn-43777.exe	110
PID 2228 wrote to memory of 4920	2228	Unicorn-43777.exe	110
PID 2228 wrote to memory of 4920	2228	Unicorn-43777.exe	110
PID 4480 wrote to memory of 4536	4480	Unicorn-28274.exe	111
PID 4480 wrote to memory of 4536	4480	Unicorn-28274.exe	111
PID 4480 wrote to memory of 4536	4480	Unicorn-28274.exe	111
PID 2748 wrote to memory of 224	2748	Unicorn-26237.exe	112
PID 2748 wrote to memory of 224	2748	Unicorn-26237.exe	112
PID 2748 wrote to memory of 224	2748	Unicorn-26237.exe	112
PID 2320 wrote to memory of 1524	2320	Unicorn-49376.exe	113
PID 2320 wrote to memory of 1524	2320	Unicorn-49376.exe	113
PID 2320 wrote to memory of 1524	2320	Unicorn-49376.exe	113
PID 4704 wrote to memory of 408	4704	Unicorn-38821.exe	114
PID 4704 wrote to memory of 408	4704	Unicorn-38821.exe	114
PID 4704 wrote to memory of 408	4704	Unicorn-38821.exe	114
PID 4684 wrote to memory of 2068	4684	Unicorn-14539.exe	115

C:\Users\Admin\AppData\Local\Temp\f1838ac21a2a5f428f0d26c25eab0830N.exe
"C:\Users\Admin\AppData\Local\Temp\f1838ac21a2a5f428f0d26c25eab0830N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21774.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
        9⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37125.exe
        10⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        10⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6722.exe
        10⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5390.exe
        9⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
        9⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        9⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        9⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4519.exe
        8⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-804.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        9⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        9⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
        9⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        8⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41227.exe
        8⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        8⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        8⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe
        7⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43723.exe
        10⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-961.exe
        9⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1520.exe
        9⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18167.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        8⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        8⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62973.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23726.exe
        8⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53723.exe
        8⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
        8⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe
        8⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        7⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
        7⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62247.exe
        7⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34437.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        9⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        9⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        8⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57200.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18187.exe
        8⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59676.exe
        8⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
        7⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        7⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe
        6⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42482.exe
        8⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        8⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34695.exe
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        7⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe
        6⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        7⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23126.exe
        7⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47853.exe
        7⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52272.exe
        6⤵
        
        PID:14092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe
        6⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
        8⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8344.exe
        9⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        9⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11932 -s 436
        10⤵
        Program crash
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
        9⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31430.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        8⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        8⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18000.exe
        8⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        8⤵
        
        PID:16264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
        8⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63147.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
        7⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45433.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14470.exe
        7⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        7⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
        6⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe
        6⤵
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48650.exe
        6⤵
        
        PID:16820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57948.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19481.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        8⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
        7⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18722.exe
        7⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10958.exe
        6⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
        6⤵
        
        PID:14708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12282.exe
        6⤵
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13683.exe
        5⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42482.exe
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        6⤵
        
        PID:14492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
        5⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8870.exe
        5⤵
        
        PID:11856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
        5⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60917.exe
        5⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31947.exe
        5⤵
        
        PID:14264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59122.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33902.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        8⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        9⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62827.exe
        9⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22826.exe
        8⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36786.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10958.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
        7⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44103.exe
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46030.exe
        7⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13349.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61867.exe
        7⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3087.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36109.exe
        6⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41442.exe
        6⤵
        
        PID:14752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        7⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8695.exe
        7⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53580.exe
        6⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4561.exe
        7⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        7⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15082.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        6⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41278.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        6⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37768.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18581.exe
        5⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33632.exe
        5⤵
        
        PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5640.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        6⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23425.exe
        8⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        8⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        8⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        7⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        7⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        7⤵
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49776.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16168.exe
        6⤵
        
        PID:11988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        6⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17264.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46030.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        6⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45068.exe
        6⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        5⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19270.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        5⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33658.exe
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63813.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
        6⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16055.exe
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7881.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27627.exe
        5⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17774.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28357.exe
        6⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45207.exe
        6⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30859.exe
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37317.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        5⤵
        
        PID:11396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        5⤵
        
        PID:15276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20947.exe
        5⤵
        
        PID:14504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8400.exe
      4⤵
      PID:8100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
      4⤵
      PID:11900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe
      4⤵
      PID:14324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
      4⤵
      PID:5168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64996.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30913.exe
        6⤵
        Executes dropped EXE
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2573.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        8⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        8⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31869.exe
        8⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30268.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58048.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28205.exe
        7⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57470.exe
        7⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        7⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4088.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17280.exe
        7⤵
        
        PID:588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
        6⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15556.exe
        6⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        5⤵
        Executes dropped EXE
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
        6⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44507.exe
        7⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        7⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34089.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11099.exe
        5⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37602.exe
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37125.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27334.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41067.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
        5⤵
        
        PID:13668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30987.exe
        5⤵
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17767.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
        6⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27374.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        7⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        7⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        7⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        7⤵
        
        PID:15660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9812.exe
        6⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        7⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        7⤵
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1867.exe
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        7⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        7⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        6⤵
        
        PID:13224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28419.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe
        5⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37616.exe
        6⤵
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46808.exe
        5⤵
        
        PID:10608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52510.exe
        5⤵
        
        PID:12792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27421.exe
        5⤵
        
        PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45578.exe
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59169.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3305.exe
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53723.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2269.exe
        7⤵
        
        PID:16252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        6⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54929.exe
        5⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        6⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61175.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19867.exe
        5⤵
        
        PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-855.exe
      4⤵
      PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17369.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        5⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22232.exe
        5⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe
        5⤵
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
        5⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        5⤵
        
        PID:13432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
      4⤵
      PID:11084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58509.exe
      4⤵
      PID:14120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
      4⤵
      PID:1772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17021.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41966.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
        6⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49034.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        8⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53998.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46509.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4690.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23320.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61646.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        7⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        7⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe
        6⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6131.exe
        7⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50127.exe
        7⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        6⤵
        
        PID:12504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6390.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        6⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64908.exe
        5⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10440.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23041.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48154.exe
        7⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        7⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42863.exe
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8554.exe
        6⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        6⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        6⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
        6⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64658.exe
        5⤵
        
        PID:12724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52542.exe
        5⤵
        
        PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43288.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        7⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        7⤵
        
        PID:13604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
        6⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32591.exe
        6⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50569.exe
        6⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36969.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46646.exe
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        5⤵
        
        PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-663.exe
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42482.exe
        5⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
        5⤵
        
        PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32335.exe
      4⤵
      PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50688.exe
        5⤵
        
        PID:15476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
      4⤵
      PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53310.exe
      4⤵
      PID:8072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58857.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14441.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        7⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10957.exe
        7⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        7⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48384.exe
        7⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        6⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        6⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60492.exe
        5⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        6⤵
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60199.exe
        6⤵
        
        PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
        5⤵
        
        PID:12436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44103.exe
      4⤵
      PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        5⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37170.exe
        5⤵
        
        PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
      4⤵
      PID:9020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
      4⤵
      PID:12568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40866.exe
      4⤵
      PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41193.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        5⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25918.exe
        6⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47628.exe
        5⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47142.exe
        5⤵
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18722.exe
        5⤵
        
        PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
      4⤵
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
        5⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33894.exe
        5⤵
        
        PID:15332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10958.exe
      4⤵
      PID:10936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
      4⤵
      PID:14264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14264 -s 472
        5⤵
        Program crash
        
        PID:15472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
    3⤵
    PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33482.exe
      4⤵
      PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13126.exe
      4⤵
      PID:8920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18548.exe
      4⤵
      PID:16144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51971.exe
      4⤵
      PID:15772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
    3⤵
    PID:7536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4405.exe
    3⤵
    PID:11888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe
    3⤵
    PID:13976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
    3⤵
    PID:5264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43777.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38489.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12744.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31982.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1504.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        9⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        9⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2845.exe
        9⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7786.exe
        8⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10652.exe
        8⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        8⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4088.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
        8⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38201.exe
        8⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-527.exe
        8⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        7⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63619.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36853.exe
        7⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37754.exe
        7⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61053.exe
        7⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
        6⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2080.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37911.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe
        8⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28205.exe
        7⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
        7⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49619.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63881.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
        7⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12282.exe
        7⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8603.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54954.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20318.exe
        6⤵
        
        PID:16056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21908.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38858.exe
        8⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
        9⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
        9⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        9⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
        9⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        8⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22197.exe
        8⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39135.exe
        8⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        8⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        8⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
        8⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        7⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        7⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        7⤵
        
        PID:16356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59849.exe
        7⤵
        
        PID:16732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40351.exe
        6⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45452.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31902.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2550.exe
        6⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        6⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
        5⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        7⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        7⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14000.exe
        6⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28205.exe
        6⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        6⤵
        
        PID:15508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
        6⤵
        
        PID:444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        6⤵
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        6⤵
        
        PID:13392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        5⤵
        
        PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe
        5⤵
        
        PID:12732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        5⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14753.exe
        5⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40575.exe
        5⤵
        
        PID:16724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41966.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
        6⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5287.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46030.exe
        8⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47091.exe
        8⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe
        8⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
        7⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61346.exe
        7⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
        7⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
        6⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        7⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49039.exe
        7⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24886.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        6⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64908.exe
        5⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48401.exe
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
        7⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34695.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe
        6⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45519.exe
        6⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52169.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        6⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
        6⤵
        
        PID:10788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        5⤵
        
        PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34958.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe
        5⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30367.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1681.exe
        7⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        7⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
        7⤵
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5390.exe
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28098.exe
        6⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45485.exe
        6⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65483.exe
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        6⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        5⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        5⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe
        5⤵
        
        PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
      4⤵
      PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
        6⤵
        
        PID:11288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63582.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10039.exe
        6⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe
        5⤵
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
      4⤵
      PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        5⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
        5⤵
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
        5⤵
        
        PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8312.exe
      4⤵
      PID:9220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54280.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
      4⤵
      PID:12236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6371.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63097.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5640.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        8⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20947.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22232.exe
        7⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe
        7⤵
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39879.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64735.exe
        7⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        7⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        7⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31814.exe
        6⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
        6⤵
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33233.exe
        6⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60497.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        6⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        6⤵
        
        PID:15268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        6⤵
        
        PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6246.exe
        5⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34071.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        5⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21068.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27410.exe
        5⤵
        
        PID:16420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        6⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        7⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
        7⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        6⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        6⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59832.exe
        5⤵
        
        PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61590.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29069.exe
        5⤵
        
        PID:15400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29955.exe
        5⤵
        
        PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58136.exe
      4⤵
      PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        5⤵
        
        PID:8744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        5⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28618.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
      4⤵
      PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2897.exe
      4⤵
      PID:12480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
      4⤵
      PID:16780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40631.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7560.exe
        5⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62729.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        8⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
        7⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
        7⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1679.exe
        7⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
        6⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21429.exe
        6⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
        6⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31711.exe
        5⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        6⤵
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26376.exe
        6⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60403.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30859.exe
        5⤵
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14036.exe
      4⤵
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        5⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14016.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2597.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56552.exe
        6⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        5⤵
        
        PID:15356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        5⤵
        
        PID:16916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57528.exe
      4⤵
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46656.exe
        5⤵
        
        PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
      4⤵
      PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
      4⤵
      PID:14292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
      4⤵
      PID:16844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45578.exe
      4⤵
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe
        5⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        6⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25048.exe
        5⤵
        
        PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
        5⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        5⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
        5⤵
        
        PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
      4⤵
      PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48334.exe
        5⤵
        
        PID:10912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33662.exe
        5⤵
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60403.exe
      4⤵
      PID:9724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
      4⤵
      PID:13744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58889.exe
      4⤵
      PID:16028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
    3⤵
    PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exe
      4⤵
      PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        5⤵
        
        PID:9280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        5⤵
        
        PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
      4⤵
      PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
      4⤵
      PID:13580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46915.exe
    3⤵
    PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
      4⤵
      PID:11548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12108.exe
      4⤵
      PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4498.exe
      4⤵
      PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52570.exe
    3⤵
    PID:10464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
    3⤵
    PID:13468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9031.exe
    3⤵
    PID:10708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17994.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17994.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17701.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64929.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        7⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51419.exe
        8⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe
        8⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22099.exe
        8⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29741.exe
        7⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe
        7⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        7⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64818.exe
        7⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        7⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
        7⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60403.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30859.exe
        6⤵
        
        PID:13676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
        6⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        5⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65417.exe
        6⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13349.exe
        7⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36786.exe
        7⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23267.exe
        6⤵
        
        PID:14328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10931.exe
        6⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30636.exe
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33894.exe
        6⤵
        
        PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-731.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        5⤵
        
        PID:13628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44374.exe
        5⤵
        
        PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12604.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        6⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
        7⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13349.exe
        7⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
        7⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
        6⤵
        
        PID:12744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20635.exe
        6⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
        6⤵
        
        PID:14508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        6⤵
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49536.exe
        6⤵
        
        PID:16508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        5⤵
        
        PID:13820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        5⤵
        
        PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41176.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
        6⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        6⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21794.exe
        6⤵
        
        PID:16740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        5⤵
        
        PID:12484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-560.exe
        5⤵
        
        PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
      4⤵
      PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41745.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        5⤵
        
        PID:15888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12282.exe
        5⤵
        
        PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57603.exe
      4⤵
      PID:9620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61958.exe
      4⤵
      PID:13568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
      4⤵
      PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30979.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23726.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11621.exe
        6⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        6⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8959.exe
        6⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35136.exe
        5⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10874.exe
        6⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5458.exe
        6⤵
        
        PID:16960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16055.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7881.exe
        5⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        5⤵
        
        PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe
      4⤵
      PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        6⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
        6⤵
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
        6⤵
        
        PID:652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45531.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2900.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8554.exe
        5⤵
        
        PID:11928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        5⤵
        
        PID:652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
      4⤵
      PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-316.exe
        5⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        5⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        5⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8695.exe
        5⤵
        
        PID:11932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54680.exe
      4⤵
      PID:8640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21788.exe
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
      4⤵
      PID:16048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52978.exe
      4⤵
      PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18329.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6914.exe
        6⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        5⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        5⤵
        
        PID:15944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
      4⤵
      PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        5⤵
        
        PID:12208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20522.exe
      4⤵
      PID:10692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53007.exe
      4⤵
      PID:14368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39070.exe
      4⤵
      PID:13972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe
    3⤵
    PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe
      4⤵
      PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        5⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35762.exe
        5⤵
        
        PID:13508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        5⤵
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25048.exe
      4⤵
      PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
      4⤵
      PID:12472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58889.exe
      4⤵
      PID:5512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16272.exe
    3⤵
    PID:8056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60437.exe
    3⤵
    PID:10980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24576.exe
    3⤵
    PID:15236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
    3⤵
    PID:16540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64929.exe
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59169.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57579.exe
        7⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
        7⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
        7⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        6⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        6⤵
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        6⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        5⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45535.exe
        6⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        5⤵
        
        PID:10720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
        5⤵
        
        PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        5⤵
        
        PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52153.exe
        5⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24331.exe
        6⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53501.exe
        7⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8258.exe
        6⤵
        
        PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        5⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        5⤵
        
        PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36039.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7192.exe
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3038.exe
        5⤵
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
        5⤵
        
        PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
      4⤵
      PID:10920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
      4⤵
      PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
      4⤵
      PID:15472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63564.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1120.exe
      4⤵
      PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5033.exe
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42814.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28419.exe
        6⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35362.exe
        5⤵
        
        PID:13236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
        5⤵
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
        5⤵
        
        PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
      4⤵
      PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62729.exe
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
        5⤵
        
        PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        5⤵
        
        PID:16164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29463.exe
      4⤵
      PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19270.exe
      4⤵
      PID:11656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
      4⤵
      PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7818.exe
    3⤵
    PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1385.exe
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
      4⤵
      PID:11444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
      4⤵
      PID:15244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-527.exe
      4⤵
      PID:760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33601.exe
    3⤵
    PID:7532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
    3⤵
    PID:11908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24101.exe
    3⤵
    PID:16256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60996.exe
    3⤵
    PID:16756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37830.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37830.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24338.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56590.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        6⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
        6⤵
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2900.exe
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8554.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        5⤵
        
        PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29791.exe
      4⤵
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57783.exe
        5⤵
        
        PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18711.exe
      4⤵
      PID:8884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
      4⤵
      PID:12320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45354.exe
      4⤵
      PID:15420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
      4⤵
      PID:5160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44296.exe
    3⤵
    PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27374.exe
      4⤵
      PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48334.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64818.exe
        5⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        5⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        5⤵
        
        PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57666.exe
      4⤵
      PID:13532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe
      4⤵
      PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
    3⤵
    PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe
      4⤵
      PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30177.exe
      4⤵
      PID:14768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
      4⤵
      PID:3188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46808.exe
    3⤵
    PID:10592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52510.exe
    3⤵
    PID:13772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43949.exe
    3⤵
    PID:16268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39657.exe
    3⤵
    PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
      4⤵
      PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        5⤵
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        5⤵
        
        PID:15260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe
        5⤵
        
        PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
      4⤵
      PID:8592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-660.exe
      4⤵
      PID:11852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
      4⤵
      PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38260.exe
    3⤵
    PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
      4⤵
      PID:9108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47091.exe
      4⤵
      PID:13080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
      4⤵
      PID:6208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
    3⤵
    PID:7940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
    3⤵
    PID:12868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10652.exe
    3⤵
    PID:15848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
    3⤵
    PID:13448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
    3⤵
    PID:7204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe
  2⤵
  PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
    3⤵
    PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31017.exe
      4⤵
      PID:8108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
      4⤵
      PID:13980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe
      4⤵
      PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11151.exe
    3⤵
    PID:9160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
    3⤵
    PID:14644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20251.exe
    3⤵
    PID:5684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16602.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16602.exe
  2⤵
  PID:1848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
    3⤵
    PID:9448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35762.exe
    3⤵
    PID:13516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
    3⤵
    PID:5420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
  2⤵
  PID:13592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
  2⤵
  PID:5224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 14292 -ip 14292
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 15836 -ip 15836
1⤵
PID:4848

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12744.exe

Filesize
468KB

MD5
75dbe7c9a8c5827f6c190a29dfba6bb0

SHA1
99892787db14ea79c139593f9a715c88579f16f2

SHA256
3ea8e9b4e109634b65e94b5769dc0cb5c6d66e0f6ac5bab322e975ee7427e89a

SHA512
811c7df57427283e4b0d62ec048761adb99ceb5738c5647ab8a557f066998c1a2718d636ed43680f494c90cf278ac0db18807302e37d567fa7e8a8f5ef19c0d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe

Filesize
468KB

MD5
ae5e096f64b07bbd140df37b580231b7

SHA1
38da2516ff4329d6d81b10722b535013e0b9b046

SHA256
95efd44d91a9f43a92d4afae6dae5ce9cef4dfca35d06465ef4b42dab6278780

SHA512
3c6f373eb150adc9d6f0461d3e9c37f545d78a19fe8a9d36790b19cac96d343cfd07ef7df6c5b25535518e7251c74967ddcb703e4cacb51b82fb497a000ca0ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe

Filesize
468KB

MD5
aa0eb9e33531ddb478618167e503f67c

SHA1
5648c3ea0e749d4eaf803b76d3047d4faba8c9fe

SHA256
0601d648b1a9def4a3635f87fe4030b280df22f1041cf87a14e7cb461452f9ef

SHA512
3d9ccf23d75170acc828a0f1d94eb3e58a9621e4a88962cac0cdb74f3a69e10f560b839c38f76a644f14a4a898b46925d36cb039a9f71db42ec1c5b08c2193d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17021.exe

Filesize
468KB

MD5
69f12fc1ad4ad55f3bf398382931a790

SHA1
b34c253edeebcd738a574d143a61d0ebb0621d30

SHA256
4f8b6cf2740e997083144cd15bad875919930bf8454d58a1d6e60db9aaf5c26c

SHA512
dcd2cc3b33ab351485e086f8501dbaa41eb1ffc1f899cc35703667fb49d0ca00f7ce65751d3b4978e10c301f405797c0ec8e0ffacca76b07f4b07afc681e6326

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17767.exe

Filesize
468KB

MD5
2ff619261764d492d5148472fa6dc02d

SHA1
f713a03ecae3a3db09470b6b280b4aae7159228b

SHA256
de200b448f5f12052951cb188119654ba3c541660d0fc38a91c8a484f9903927

SHA512
64aac585417683a6ce17618cedea26efeb46f878547510be6b9bcefe0a451baa6afa4ee6f903e46e2f36af0ecfc53a8a1f748f72434bf1802d3335e6b05fb44a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17994.exe

Filesize
468KB

MD5
4a56d05f2056d7e28c77277b95544f94

SHA1
e85a0852722fca79929cea392f52d9ef1f1755df

SHA256
7ef2058c72324f11a3adee2895bfc4c4ac0600648d7bcbae006baa44e72c76ad

SHA512
700b78e965ea45f1d63d1949d7cb6d00341a96f8abbc42d4d29611461cb51ac9e97a06c8bae0315795892d24f2ce645ab6cccf87631b6b4b5ac0105d05f1d951

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe

Filesize
468KB

MD5
3e0fb7c720c7a5abb56f131729cd3e8e

SHA1
b63e96cacc583b6347e75b52df8c4a1467422d42

SHA256
ab8504ef31cd1ea5ccfd39259d4a1ca4edb771ff03690945b34b2456b86db58e

SHA512
6109dcfdb5fa3a20e0b87f2adafdcd29667e1f7e3af9aead2abeec40ace77026164027299b444ef824cb5999cc58ed0068e959e9121685565433627334560e29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe

Filesize
468KB

MD5
7a9dcac975baa26a5516dc286c2fc9c9

SHA1
4ef7725a628d4555acbef1a9a8b89b8aed58cd17

SHA256
b6d079938814ffef2a97d31da221121bf6de6aa3ee711ab5ea21397692e8cb12

SHA512
440ab41bb8c08138b98697cd866e06bee12fe266f634b4ff6eed316a8dec2beca3506dde7a2d8ab0cace428659a40b70bd7c42f8f7814d0d380d6d9f61a0ca42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21774.exe

Filesize
468KB

MD5
9f69202c141d5f2f17fa308e42f20103

SHA1
81c4e3af8ce3bcf4eb2d8d653091111d393ac95f

SHA256
c398f6221b677c55f8e11ae229a4135701cb4beeac2b881c4529fa7ef3c087c1

SHA512
582e8b2b73b0d74430663bd2d29f723516d0148eedac0b6757db008eee85e711551fcd6a5aafac1c9bc67e000857b7ae8f0247f660717133507b033cf9704c14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21908.exe

Filesize
468KB

MD5
fba919320f2f5d517160350360fc1d92

SHA1
b96a121dfdac5b6bedb9c462d402edbb2cf72fd5

SHA256
be9b8ed3d64cf6a362cd22f7751e7922935747631afc8f6c85ca8190d4113c07

SHA512
15ddc09fe3b5c1bfd45c26190ed830f33c2eb693be9b3dc6e34b20151e3574f4c807efaa67aa9ea2234946eed967c4d47fc43dccf77b3827b255f1dafb651a6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe

Filesize
468KB

MD5
da50cf22bb4328d01c2e64067ac3caf0

SHA1
c93f525c45abbf23b2c4673bfab072faf9bb2fa7

SHA256
a2c5fc74ea0f2ec873249e26d1db6e89f8b4b7e5927829405ed4db85e54026ad

SHA512
2926f95531e0f45d9370ebbc8e6baddd935a12826349168724b56fc18dd2b130cf21ee1a1df7899619a9a85968f47c1d88692b8e1e7b6effe7e57296e73e1883

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe

Filesize
468KB

MD5
d09b17f861ed3e912f54c40f4e52f32e

SHA1
9f80b2fc2b0aa5a9d339d6b53676f8bc7c202699

SHA256
5f5fb56f9ec99798fd99e0180001938a229eeef29383e1743a3fc1f8fe821118

SHA512
9475d82fc45910b4802e3f9ad206dac7f6437a2ea63e3444469ebe5d916f3610a9f57051b2b496c6e19d5b302492a0cdc1d750b73ccf6c720ec92b89c73dfc43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe

Filesize
468KB

MD5
1c1b37055e411f901e7de363bc376cec

SHA1
de4bf3478821122b76f8f7cdcbd0c09a1e116289

SHA256
642c31a5a7db8d9f3020c686493cf0186c675f660c5fd3a4d7d25d7703890647

SHA512
4f7225eb23b9a4e3324b922e43e19af0cafe78edadf8119095082f842cda472c988863a7cca1e52ad67f4b3e229a476ba9a9a7ca6b3864b86314fd3a6e03a1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe

Filesize
468KB

MD5
766f071125eb6c56c0014c34e7af617d

SHA1
2b211aef23bafc2ac29049424ab64ef94de17d31

SHA256
9b0c2bd8231e700c27f43d31cfee6ac0753d55a2e248418a05f617efe371a2c8

SHA512
477519ea063b5d930c854669ddcdf2fdb0ce06f4b6f952f3dac2535100f2ff9a07adddb47aa9d9ed2d2a0936042788f72c8017cfd8e4e043fc0a440c2661caab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30979.exe

Filesize
468KB

MD5
993ad16e22f8bd31f30f4452d9020513

SHA1
27f51cc00e8a8f6a7b7103e5d2249be6ea663f55

SHA256
a53f4ec47126e06daf1812c95bd3780433ab625d6858695f5f7880ecc9273b91

SHA512
3fa6e5912900935366b1e9b88c8511bc821484bdc9e9c20145727747f58f1716cfb33a6250aabf57fa5fb68c56c16be76845e694284705f6981bd342a8b123a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe

Filesize
468KB

MD5
61d091f580a63b984f555afe2873ada2

SHA1
b06e0b419a0931401d5edfe53a40789e6075f37e

SHA256
cdd9c8de60d830c1e0e2bdbb920c5eaa8737bdfeb2d98c9306db04447298b51f

SHA512
35796999e0fe58aecfad5656dc2028d20f18aa50233938908201faadfbe146d6188d74d0c97cf0e050e0e9d3e1dbc8b2bab68c2eb0c3c32cf56e1ae089847e60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37830.exe

Filesize
468KB

MD5
d1fb2a218ce09cb5584f5d422a2750fc

SHA1
256d354ff75b1121d418e7f73367cc0dff4150bb

SHA256
496a443f9b3413eb3bab93f49e004132516d9a4a83b5430ec124e040b0d0777a

SHA512
d36b4d757375c38a6dd303d02d9f35b0711b136e150dbe2ca5347f5a68b966de9db44812aa3bbcf2acf72bfe998347adc13a60f988f85c1e8e4abda71cf33d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38489.exe

Filesize
468KB

MD5
12c8bc9ebe1408a99ef8a66d05548b20

SHA1
1f323112b3a68f832c721f22f1fbfe44bbf84339

SHA256
e257b298aeacda39f0e1ce7cb50fac6a44aa7c1d492e15d3a68eeb977f3f8c29

SHA512
570745dedc1072df3fe93ec8535fab6fa34aef3c0971b21ee5526f902b73a902036847f46b7a86d4830444bfae475aa73279d51ce25c20bf48b3d2645bd78cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe

Filesize
468KB

MD5
082a45e8ea3237699606b42b74f8beb9

SHA1
26e2567d535795309ee93805e61718b612f7fbfd

SHA256
e27b4c676f61a6f84fd8cd296b75cb8e48c7621fde8a39c4ce52757fccd17aeb

SHA512
7fe658718aa44c4777b9b9ad8da3209ac2ed56705ca015f99f4d03d34f1315e5ad3e68cdcf58560d25872324f0be9e066ff8114e69c5436300aaa3926c646acc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40631.exe

Filesize
468KB

MD5
28257e2b86f195e4dd30e1323e418607

SHA1
fff06b0fb11523bf441fe82c54e7488c2001c2e0

SHA256
403a802cd458e55009e45e06d26f395cc8379ffba975f551cdf37c3010510e79

SHA512
4dd5e5101cbbfe822fcc8749394f3cb6cafcc6a97d7803516776616863e5feb16e4919087c04df127f9c12500d259e55745efbe1239f2156b1f5fbd83ff22410

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43231.exe

Filesize
468KB

MD5
7998299a3334324c221a4f45bd7215ad

SHA1
b724e2a5b98cea9df809378db61ecb3c58b79b98

SHA256
25548b54a6a3ac90de5d0bff85924d3204db2e2877c556fb79acdf50c056d34c

SHA512
442bafdc427baf6fc5de0797a605b88f4b0d7a3e0d45800d86a291c2012317a426c915aea8fb39c24b44ccdb791807f83bc6a16a2badead6ca3ec2e919948829

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43777.exe

Filesize
468KB

MD5
1f7f77cb7e0c2cf4ceb140f38c4c7bc5

SHA1
87b191d8f8b77267ed208139a9b3faa4537034e3

SHA256
d9e78c0de68b09d0ee6af32863d12d2b3ef6f19b31bdcc186cdef18f616180ab

SHA512
8bd721bd5105d30766e455c60b254f10df417154f64406e3384927a00d52b72c5be576bc8e885f460d0c9716ebc57b2410fc8cbca34afd83e012d65090ba5765

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe

Filesize
468KB

MD5
17e4e9ad5bd6d1b24c9a7354230b0746

SHA1
029518994ab12998022c534e6d9437742f06674f

SHA256
8eacf864fe7a41896b2bf9065af9f5975fc014fdf1cc4168958ac616455f5479

SHA512
717fb841da4d3b391e0f0218e8c2728f3436e13e87163d80739cd8006f0b5021412fdd8880c2493ac00469abb36bb10e7620056fd94e7606d92ada0f6e2e0d22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe

Filesize
468KB

MD5
4c46c9c97cf1bebf74a7dd7efa563707

SHA1
e9819e0f6f787d6ec727a8dab9e1f27f64a46d42

SHA256
3fc8be36a25f655ce7b61ad555540194a66b0030317bb7695afef7c293128d3a

SHA512
647e44ffab68d32b75e9e4e8a64a1867b240fc79ad2312b35f95f46b288509aaa1032ee9873cc950a2316e122ffe7b2a2ab7459294e8272f2bd5ec80fed944ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe

Filesize
468KB

MD5
ae53ad1c5c0b5705ad3d41773f269e7c

SHA1
94a0d5a612d496b009b7c16effeb19189595521f

SHA256
523f4c2f62a54d1a0cd2296f6b17fa284d69b3c035566e69d0572b3464581d55

SHA512
73a4a6e47f2a69230c7c9a142f8348231463c258eb8a095360724c5295e26a5bc215ca8901a530237144398025962a19be5132d6b9ee312615d15c1913e096ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58857.exe

Filesize
468KB

MD5
1411b83f8d74190c3657e95062b47763

SHA1
5fe85b2a8dea0253c4eb7b868902e17d0b0c62fa

SHA256
02ec2bf9dacef80305cbe167bee60f33455038ae696fb9539c1ec11c40f32418

SHA512
bcc76f1b31c78bfed751fc199ceba9c16b491c9b6c727b3761738149e9cc51a7fc6e3b5c7e9ac743421b3be7f1e42f7c10e1af9aaee066f0851eae2bb6c32f0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59122.exe

Filesize
468KB

MD5
21aaada3a91fa6fd05b54f482a7ffe96

SHA1
c99f69f6cd826f00ff0a8e86d87ae0036d0d8dfb

SHA256
3306556c3dccfae2f112851e859165240257136d30a22aa70ea8f08c2c461763

SHA512
6b5de8bff1ba86d79cfb0d55a1067453a60c644bb3ea0108915fe3dd76082e01c999f86ebeb885c7180ff2d137f6ef74c052b39044adc816ed6dfac31a16beaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe

Filesize
468KB

MD5
064cde220edb72d9c740a00f96930c2a

SHA1
5c2e4621288d932ba5c35169e6af25a4961ea1f0

SHA256
074f66c677b5c42e396bded826dffbf36836579d4f1756b3032072e4e6fe58c0

SHA512
acfb4d239b76caa5b1046539ed39d11f0c242ba2ea01d9de664dca4511153f8c266f72bc35b962bece0e1dc70c56e294cb9a7dc3d75e15aff17bc8e4dc83d9ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63097.exe

Filesize
468KB

MD5
fdeb9e9e955cd956d7b3e9dc45864775

SHA1
c18ef691bcefcbe0189930fc7fa639bdeef02158

SHA256
b974a8c61d276ec565ab2ccbf73d1cab2a557d7fd994cd2d22bc156824cb28ac

SHA512
8001a12fb84c965e696be75becb66712a75cc52240d3b67f24173dfd4dc345b1dc638191d1c6c9dfb94ba6157b91ccf3373878fdecde37aa6a46ce411133430d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6371.exe

Filesize
468KB

MD5
cbfc1151507bbc35b13fbe6975bd20e2

SHA1
0bae24f799183e6bc2f153af48b765f3e59a9f56

SHA256
cb047a7abe8f244f2fa751942b58150a05585607b9336b710124322304d561f8

SHA512
3592370b0b4e276a5d3dbd611ff6d636b49c78cfcb719e942f28438aa781a414477ff10be6d261c16769cc1c0ca7acc73814271fb357b2b36265175d5449f524

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64735.exe

Filesize
468KB

MD5
0c8d8588b3e873e7b70f9e83f69208de

SHA1
cc296b9ed097f6e4d4449dd7cc21319a5fa641c6

SHA256
a8d0c67aca836cf15adf4905333d8e07697712c5863e81e065073b4304f5f026

SHA512
c4656caaa1658d44a393738c6267a2b24c5e4c79f8550f0e6012dbd610014897f010ffbf90c514bba174625f8329d5959a1b7f35ba078e9b1fb3e76154177e39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64996.exe

Filesize
468KB

MD5
6c23a2a478e95fecd86211fe9326e8fa

SHA1
85a20418734c8407375891a418cbda8e9e1bb5ee

SHA256
609f45ec2fd84fd812b012329b60b78d6dcd64a41a20bf9babd734556b190ab9

SHA512
6ddd328894874f825a0a27772265f050aa1697f151c71e7f2b49274d881bfd079a872d9df5789891a801a8e44c8e451f541f68ebefe5d2674219fd5e5dcab182

Download Submit
memory/224-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/376-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/408-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/432-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/724-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/732-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/836-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/976-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1108-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1180-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1412-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1720-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1780-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1784-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1792-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1860-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1920-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2068-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2320-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3136-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3140-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3176-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3280-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3684-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3688-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3732-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3892-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3996-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4060-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4348-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4444-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4684-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4704-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4712-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4728-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5016-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5312-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5380-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5580-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5608-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5628-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5656-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5688-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5860-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5872-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5888-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5912-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5944-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5968-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5976-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5984-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6012-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6032-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6064-572-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6084-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6112-578-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6136-569-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15840-2720-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads