8e6cab597d7f6edd9bff7f98f42d678cfd63fa737828b5bede278be4cc72e935

Analysis

max time kernel
119s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed07f1dfa66bb47149ba37c87fb2bbf0N.exe
Size

468KB
MD5

ed07f1dfa66bb47149ba37c87fb2bbf0
SHA1

3d94faa072edf1878cba695f673b4aa5e860a0a4
SHA256

8e6cab597d7f6edd9bff7f98f42d678cfd63fa737828b5bede278be4cc72e935
SHA512

c2df47b669ac6276c740804fca744f378b0917b1d2fa984b465359f74a0740bde34df62e97085092edba30747a78696cd3c9eb99c6deb51cd907e0bec7b02fb0
SSDEEP

3072:uqoCogLdj88U2bxnPzYWffVkCL78XpXnmHevVpDjaD3xFT4D5lW:uqNooRU21P8WffQ5hrjabvT4D

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4456	Unicorn-23505.exe
2056	Unicorn-38025.exe
4344	Unicorn-1823.exe
4904	Unicorn-27885.exe
4616	Unicorn-1195.exe
2084	Unicorn-8808.exe
3596	Unicorn-60047.exe
3960	Unicorn-18897.exe
5088	Unicorn-48232.exe
4240	Unicorn-2560.exe
2372	Unicorn-63748.exe
2332	Unicorn-64013.exe
3288	Unicorn-37271.exe
2088	Unicorn-23535.exe
3488	Unicorn-34163.exe
1700	Unicorn-37501.exe
3700	Unicorn-46224.exe
552	Unicorn-26209.exe
4132	Unicorn-3550.exe
3332	Unicorn-50713.exe
2920	Unicorn-42353.exe
5036	Unicorn-32138.exe
1612	Unicorn-18403.exe
3964	Unicorn-17849.exe
2640	Unicorn-21933.exe
380	Unicorn-57927.exe
1892	Unicorn-5139.exe
3552	Unicorn-51076.exe
4632	Unicorn-61569.exe
368	Unicorn-38911.exe
1828	Unicorn-36873.exe
2776	Unicorn-36873.exe
3224	Unicorn-8839.exe
2552	Unicorn-22574.exe
2040	Unicorn-287.exe
3096	Unicorn-3624.exe
1148	Unicorn-44465.exe
4340	Unicorn-54169.exe
3208	Unicorn-49244.exe
336	Unicorn-49509.exe
460	Unicorn-5139.exe
2124	Unicorn-24740.exe
948	Unicorn-62316.exe
1460	Unicorn-58793.exe
3428	Unicorn-6063.exe
4396	Unicorn-50625.exe
3432	Unicorn-46541.exe
2188	Unicorn-9592.exe
3680	Unicorn-46541.exe
2484	Unicorn-17761.exe
1176	Unicorn-46541.exe
656	Unicorn-41303.exe
3164	Unicorn-46904.exe
4012	Unicorn-53755.exe
376	Unicorn-38735.exe
3744	Unicorn-56555.exe
756	Unicorn-26697.exe
1680	Unicorn-64200.exe
4968	Unicorn-55093.exe
4756	Unicorn-2887.exe
4724	Unicorn-56437.exe
4984	Unicorn-35633.exe
4488	Unicorn-7044.exe
1872	Unicorn-60329.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
8004	5508	WerFault.exe	182
8724	5524	WerFault.exe	183
9848	5336	WerFault.exe	201
12708	7196	WerFault.exe	289

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18863.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16112	dwm.exe
Token: SeChangeNotifyPrivilege	16112	dwm.exe
Token: 33	16112	dwm.exe
Token: SeIncBasePriorityPrivilege	16112	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe
4456	Unicorn-23505.exe
2056	Unicorn-38025.exe
4344	Unicorn-1823.exe
4904	Unicorn-27885.exe
2084	Unicorn-8808.exe
3596	Unicorn-60047.exe
4616	Unicorn-1195.exe
3960	Unicorn-18897.exe
4240	Unicorn-2560.exe
5088	Unicorn-48232.exe
2372	Unicorn-63748.exe
2332	Unicorn-64013.exe
2088	Unicorn-23535.exe
3288	Unicorn-37271.exe
3488	Unicorn-34163.exe
1700	Unicorn-37501.exe
3700	Unicorn-46224.exe
552	Unicorn-26209.exe
4132	Unicorn-3550.exe
3332	Unicorn-50713.exe
2920	Unicorn-42353.exe
5036	Unicorn-32138.exe
1612	Unicorn-18403.exe
380	Unicorn-57927.exe
1892	Unicorn-5139.exe
3964	Unicorn-17849.exe
3552	Unicorn-51076.exe
2640	Unicorn-21933.exe
4632	Unicorn-61569.exe
2552	Unicorn-22574.exe
1828	Unicorn-36873.exe
368	Unicorn-38911.exe
3224	Unicorn-8839.exe
2776	Unicorn-36873.exe
2040	Unicorn-287.exe
3096	Unicorn-3624.exe
1148	Unicorn-44465.exe
4340	Unicorn-54169.exe
336	Unicorn-49509.exe
3208	Unicorn-49244.exe
460	Unicorn-5139.exe
2124	Unicorn-24740.exe
948	Unicorn-62316.exe
1460	Unicorn-58793.exe
3428	Unicorn-6063.exe
3432	Unicorn-46541.exe
4396	Unicorn-50625.exe
2484	Unicorn-17761.exe
4012	Unicorn-53755.exe
3164	Unicorn-46904.exe
376	Unicorn-38735.exe
3680	Unicorn-46541.exe
656	Unicorn-41303.exe
2188	Unicorn-9592.exe
1176	Unicorn-46541.exe
3744	Unicorn-56555.exe
1680	Unicorn-64200.exe
756	Unicorn-26697.exe
4968	Unicorn-55093.exe
4724	Unicorn-56437.exe
4756	Unicorn-2887.exe
3304	Unicorn-2960.exe
1132	Unicorn-43993.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 4456	2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe	89
PID 2264 wrote to memory of 4456	2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe	89
PID 2264 wrote to memory of 4456	2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe	89
PID 4456 wrote to memory of 2056	4456	Unicorn-23505.exe	92
PID 4456 wrote to memory of 2056	4456	Unicorn-23505.exe	92
PID 4456 wrote to memory of 2056	4456	Unicorn-23505.exe	92
PID 2264 wrote to memory of 4344	2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe	93
PID 2264 wrote to memory of 4344	2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe	93
PID 2264 wrote to memory of 4344	2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe	93
PID 2056 wrote to memory of 4904	2056	Unicorn-38025.exe	95
PID 2056 wrote to memory of 4904	2056	Unicorn-38025.exe	95
PID 2056 wrote to memory of 4904	2056	Unicorn-38025.exe	95
PID 4456 wrote to memory of 4616	4456	Unicorn-23505.exe	96
PID 4456 wrote to memory of 4616	4456	Unicorn-23505.exe	96
PID 4456 wrote to memory of 4616	4456	Unicorn-23505.exe	96
PID 4344 wrote to memory of 2084	4344	Unicorn-1823.exe	97
PID 4344 wrote to memory of 2084	4344	Unicorn-1823.exe	97
PID 4344 wrote to memory of 2084	4344	Unicorn-1823.exe	97
PID 2264 wrote to memory of 3596	2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe	98
PID 2264 wrote to memory of 3596	2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe	98
PID 2264 wrote to memory of 3596	2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe	98
PID 4904 wrote to memory of 3960	4904	Unicorn-27885.exe	101
PID 4904 wrote to memory of 3960	4904	Unicorn-27885.exe	101
PID 4904 wrote to memory of 3960	4904	Unicorn-27885.exe	101
PID 2056 wrote to memory of 5088	2056	Unicorn-38025.exe	102
PID 2056 wrote to memory of 5088	2056	Unicorn-38025.exe	102
PID 2056 wrote to memory of 5088	2056	Unicorn-38025.exe	102
PID 3596 wrote to memory of 4240	3596	Unicorn-60047.exe	103
PID 3596 wrote to memory of 4240	3596	Unicorn-60047.exe	103
PID 3596 wrote to memory of 4240	3596	Unicorn-60047.exe	103
PID 2264 wrote to memory of 2372	2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe	105
PID 2264 wrote to memory of 2372	2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe	105
PID 2264 wrote to memory of 2372	2264	ed07f1dfa66bb47149ba37c87fb2bbf0N.exe	105
PID 4616 wrote to memory of 2332	4616	Unicorn-1195.exe	104
PID 4616 wrote to memory of 2332	4616	Unicorn-1195.exe	104
PID 4616 wrote to memory of 2332	4616	Unicorn-1195.exe	104
PID 4456 wrote to memory of 3288	4456	Unicorn-23505.exe	106
PID 4456 wrote to memory of 3288	4456	Unicorn-23505.exe	106
PID 4456 wrote to memory of 3288	4456	Unicorn-23505.exe	106
PID 4344 wrote to memory of 2088	4344	Unicorn-1823.exe	107
PID 4344 wrote to memory of 2088	4344	Unicorn-1823.exe	107
PID 4344 wrote to memory of 2088	4344	Unicorn-1823.exe	107
PID 2084 wrote to memory of 3488	2084	Unicorn-8808.exe	108
PID 2084 wrote to memory of 3488	2084	Unicorn-8808.exe	108
PID 2084 wrote to memory of 3488	2084	Unicorn-8808.exe	108
PID 3960 wrote to memory of 1700	3960	Unicorn-18897.exe	109
PID 3960 wrote to memory of 1700	3960	Unicorn-18897.exe	109
PID 3960 wrote to memory of 1700	3960	Unicorn-18897.exe	109
PID 4904 wrote to memory of 3700	4904	Unicorn-27885.exe	110
PID 4904 wrote to memory of 3700	4904	Unicorn-27885.exe	110
PID 4904 wrote to memory of 3700	4904	Unicorn-27885.exe	110
PID 2088 wrote to memory of 552	2088	Unicorn-23535.exe	111
PID 2088 wrote to memory of 552	2088	Unicorn-23535.exe	111
PID 2088 wrote to memory of 552	2088	Unicorn-23535.exe	111
PID 4344 wrote to memory of 4132	4344	Unicorn-1823.exe	112
PID 4344 wrote to memory of 4132	4344	Unicorn-1823.exe	112
PID 4344 wrote to memory of 4132	4344	Unicorn-1823.exe	112
PID 2332 wrote to memory of 3332	2332	Unicorn-64013.exe	113
PID 2332 wrote to memory of 3332	2332	Unicorn-64013.exe	113
PID 2332 wrote to memory of 3332	2332	Unicorn-64013.exe	113
PID 5088 wrote to memory of 2920	5088	Unicorn-48232.exe	114
PID 5088 wrote to memory of 2920	5088	Unicorn-48232.exe	114
PID 5088 wrote to memory of 2920	5088	Unicorn-48232.exe	114
PID 2056 wrote to memory of 5036	2056	Unicorn-38025.exe	115

C:\Users\Admin\AppData\Local\Temp\ed07f1dfa66bb47149ba37c87fb2bbf0N.exe
"C:\Users\Admin\AppData\Local\Temp\ed07f1dfa66bb47149ba37c87fb2bbf0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38025.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        9⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        10⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        10⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        10⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        10⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14762.exe
        9⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10887.exe
        9⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
        9⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15139.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44053.exe
        9⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        10⤵
        
        PID:15516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe
        9⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
        9⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        9⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27974.exe
        8⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        8⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        8⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38463.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exe
        8⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        9⤵
        
        PID:16840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        8⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        8⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54821.exe
        8⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36571.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12340.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        8⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        8⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        7⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        7⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8839.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43993.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
        8⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        9⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
        10⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
        10⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        9⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        9⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15148.exe
        9⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41763.exe
        8⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        8⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe
        8⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        8⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        8⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20540.exe
        8⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        7⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51292.exe
        7⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14791.exe
        7⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2496.exe
        7⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62175.exe
        6⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13515.exe
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        8⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47156.exe
        8⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18374.exe
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51292.exe
        7⤵
        
        PID:13464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe
        7⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2496.exe
        7⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        7⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        6⤵
        
        PID:16236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
        6⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46224.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
        7⤵
        Executes dropped EXE
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
        8⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19741.exe
        9⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48449.exe
        10⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27748.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
        9⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
        9⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13795.exe
        9⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
        8⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        8⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18543.exe
        8⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27879.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        8⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2527.exe
        8⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        8⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        7⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        7⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48440.exe
        6⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60581.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
        8⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        8⤵
        
        PID:16916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43788.exe
        7⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        8⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        8⤵
        
        PID:312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32598.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14459.exe
        7⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24318.exe
        6⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
        7⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53980.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        6⤵
        
        PID:13840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
        6⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22574.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55093.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14504.exe
        8⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48101.exe
        9⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        9⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        8⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51151.exe
        8⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        7⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        7⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5861.exe
        7⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11439.exe
        6⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64525.exe
        8⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        8⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        8⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        7⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45131.exe
        6⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        6⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2887.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65233.exe
        7⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7196 -s 648
        8⤵
        Program crash
        
        PID:12708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5336 -s 752
        7⤵
        Program crash
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6699.exe
        6⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7570.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        6⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8943.exe
        6⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22673.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1396.exe
        7⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41764.exe
        7⤵
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        6⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
        5⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        5⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
        5⤵
        
        PID:13676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48232.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42353.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        9⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3242.exe
        9⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18543.exe
        9⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        8⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
        8⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe
        8⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54740.exe
        7⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        8⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        8⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27326.exe
        8⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        8⤵
        
        PID:16832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
        7⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        7⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        7⤵
        
        PID:17164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37147.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45057.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        8⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        8⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        8⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        7⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41231.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-908.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
        7⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        7⤵
        
        PID:16996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14578.exe
        6⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        6⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62316.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11896.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25981.exe
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        8⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43367.exe
        8⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        8⤵
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        8⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        7⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        7⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
        7⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8419.exe
        6⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        7⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15179.exe
        7⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        7⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46172.exe
        6⤵
        
        PID:13332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14894.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53033.exe
        6⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12532.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33279.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27209.exe
        7⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6291.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
        6⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53440.exe
        5⤵
        
        PID:13812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24657.exe
        5⤵
        
        PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32138.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54169.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64221.exe
        6⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36889.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31550.exe
        8⤵
        
        PID:14268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57103.exe
        7⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50104.exe
        7⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        7⤵
        
        PID:16676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27495.exe
        6⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
        7⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        7⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45621.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19142.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        6⤵
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59384.exe
        6⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        5⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45589.exe
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3731.exe
        7⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        7⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10923.exe
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        6⤵
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18543.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        6⤵
        
        PID:17048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41091.exe
        5⤵
        
        PID:12892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59914.exe
        5⤵
        
        PID:652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53033.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20037.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
        7⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27326.exe
        7⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        7⤵
        
        PID:16732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41343.exe
        6⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        6⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe
        6⤵
        
        PID:16708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35471.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        6⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        6⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        6⤵
        
        PID:17064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3958.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24012.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48824.exe
        5⤵
        
        PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        6⤵
        
        PID:11932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        5⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
        5⤵
        
        PID:12560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38964.exe
        5⤵
        
        PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7915.exe
      4⤵
      PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
        5⤵
        
        PID:12700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        5⤵
        
        PID:12656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1392.exe
      4⤵
      PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
      4⤵
      PID:12320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe
      4⤵
      PID:16276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53496.exe
      4⤵
      PID:17196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1195.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58793.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        7⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        8⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        9⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
        9⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        9⤵
        
        PID:17128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30959.exe
        8⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
        8⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14791.exe
        8⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
        8⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44053.exe
        8⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
        8⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        8⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63877.exe
        8⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        7⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42848.exe
        7⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25855.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50485.exe
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        8⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        7⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
        7⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9076.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45443.exe
        7⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47733.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28272.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe
        6⤵
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45692.exe
        6⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6063.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        8⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56212.exe
        8⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54120.exe
        8⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe
        7⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28898.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-784.exe
        7⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
        6⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
        7⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2055.exe
        7⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        7⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        6⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        5⤵
        
        PID:5508
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5508 -s 616
        6⤵
        Program crash
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
        5⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3072.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        6⤵
        
        PID:17112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50700.exe
        5⤵
        
        PID:14560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51850.exe
        5⤵
        
        PID:16568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        6⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35117.exe
        7⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19321.exe
        8⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        7⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        7⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
        7⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27206.exe
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        6⤵
        
        PID:12604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
        6⤵
        
        PID:15552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        6⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        5⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19933.exe
        6⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        6⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61624.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37208.exe
        6⤵
        
        PID:16696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35287.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        5⤵
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
        5⤵
        
        PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65344.exe
      4⤵
      PID:9856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
      4⤵
      PID:14196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
      4⤵
      PID:4188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46489.exe
        6⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
        8⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30923.exe
        8⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        8⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe
        7⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22532.exe
        7⤵
        
        PID:16468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
        6⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47333.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        7⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
        7⤵
        
        PID:16636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63648.exe
        6⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30899.exe
        6⤵
        
        PID:16532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
        5⤵
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe
        6⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51381.exe
        7⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64977.exe
        7⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19963.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19874.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        5⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27577.exe
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe
        6⤵
        
        PID:16428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13435.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        5⤵
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22428.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38735.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48492.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3242.exe
        7⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6291.exe
        7⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57348.exe
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64252.exe
        5⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25221.exe
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45443.exe
        6⤵
        
        PID:15516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50104.exe
        6⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8943.exe
        6⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        5⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        5⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        5⤵
        
        PID:13652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30654.exe
      4⤵
      PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4115.exe
        6⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
        6⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        5⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
        5⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6291.exe
        5⤵
        
        PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64776.exe
      4⤵
      PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26877.exe
        5⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24571.exe
        5⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33787.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13173.exe
      4⤵
      PID:1368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5139.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
        5⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19217.exe
        7⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2055.exe
        7⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        7⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40769.exe
        6⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31395.exe
        5⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        6⤵
        
        PID:14884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3486.exe
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        5⤵
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
      4⤵
      PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        5⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14468.exe
        6⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39683.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        6⤵
        
        PID:16988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38413.exe
        5⤵
        
        PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
      4⤵
      PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
      4⤵
      PID:13912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34045.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13728.exe
        5⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61012.exe
        6⤵
        
        PID:14284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        6⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        5⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        5⤵
        
        PID:17080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
      4⤵
      PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11863.exe
        5⤵
        
        PID:16056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        5⤵
        
        PID:13416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17362.exe
      4⤵
      PID:9876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
      4⤵
      PID:15300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
      4⤵
      PID:3360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
    3⤵
    PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
      4⤵
      PID:9172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
      4⤵
      PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
    3⤵
    PID:8696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
    3⤵
    PID:11980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe
    3⤵
    PID:3176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9156.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        9⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
        9⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        9⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        8⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2850.exe
        8⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        8⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
        8⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35687.exe
        8⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe
        7⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        7⤵
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        7⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        7⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35376.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
        6⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15949.exe
        6⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64200.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65456.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3242.exe
        7⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63468.exe
        7⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44695.exe
        6⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26005.exe
        7⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        7⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61624.exe
        6⤵
        
        PID:11988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52155.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29636.exe
        6⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        6⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        7⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
        7⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
        7⤵
        
        PID:17228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
        6⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
        6⤵
        
        PID:15692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45324.exe
        5⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
        5⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47859.exe
        5⤵
        
        PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60329.exe
        5⤵
        Executes dropped EXE
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        6⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
        7⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        7⤵
        
        PID:17088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31151.exe
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60820.exe
        6⤵
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        6⤵
        
        PID:16884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42295.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41505.exe
        6⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
        6⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8706.exe
        5⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        5⤵
        
        PID:12916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2457.exe
        5⤵
        
        PID:17040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
      4⤵
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55809.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        6⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2180.exe
        7⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        7⤵
        
        PID:15776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25775.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38131.exe
        6⤵
        
        PID:14936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
        6⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21639.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
        5⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe
        5⤵
        
        PID:15700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17872.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18863.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        5⤵
        
        PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
      4⤵
      PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58232.exe
      4⤵
      PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3624.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43993.exe
        6⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2524.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        9⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        8⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51151.exe
        8⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23125.exe
        8⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25723.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        7⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
        7⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30244.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4438.exe
        6⤵
        
        PID:14096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
        6⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        5⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50485.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38589.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        6⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        6⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48440.exe
        5⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        6⤵
        
        PID:14896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60831.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12599.exe
        5⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
        5⤵
        
        PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5139.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
        6⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
        7⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39683.exe
        7⤵
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        7⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63247.exe
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        6⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
        5⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52377.exe
        6⤵
        
        PID:11532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        6⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63631.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37800.exe
        5⤵
        
        PID:14492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        5⤵
        
        PID:17348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47759.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        6⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        5⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60303.exe
        5⤵
        
        PID:12664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
      4⤵
      PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39637.exe
        5⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        5⤵
        
        PID:14368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        5⤵
        
        PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
      4⤵
      PID:10552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5840.exe
      4⤵
      PID:15956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42467.exe
      4⤵
      PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44465.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
        5⤵
        Executes dropped EXE
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        6⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33389.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
        8⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe
        8⤵
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
        7⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        7⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46144.exe
        6⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
        6⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53499.exe
        6⤵
        
        PID:16012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45612.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40295.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48440.exe
        6⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62968.exe
        5⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe
        5⤵
        
        PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3515.exe
      4⤵
      PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64709.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11572.exe
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3242.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
        5⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49127.exe
        5⤵
        
        PID:13184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
      4⤵
      PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-664.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37939.exe
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
      4⤵
      PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12886.exe
      4⤵
      PID:12492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2545.exe
      4⤵
      PID:15972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
      4⤵
      PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47591.exe
        6⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        6⤵
        
        PID:17072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26491.exe
        5⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        5⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56736.exe
        5⤵
        
        PID:16264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10095.exe
        5⤵
        
        PID:17260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2527.exe
        5⤵
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44239.exe
        5⤵
        
        PID:15964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
        5⤵
        
        PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48115.exe
      4⤵
      PID:9552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19735.exe
      4⤵
      PID:13828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
    3⤵
    PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
      4⤵
      PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45304.exe
        5⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        5⤵
        
        PID:16948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
      4⤵
      PID:9956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
      4⤵
      PID:13072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
      4⤵
      PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
    3⤵
    PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      4⤵
      PID:9924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
      4⤵
      PID:14232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
      4⤵
      PID:4336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
    3⤵
    PID:10692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46234.exe
    3⤵
    PID:14584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
    3⤵
    PID:6884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53889.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48625.exe
        8⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        8⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        8⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        8⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45427.exe
        7⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
        7⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19031.exe
        7⤵
        
        PID:60
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35471.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        7⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24395.exe
        7⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
        7⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        6⤵
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        6⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16919.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        6⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-280.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
        7⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        6⤵
        
        PID:12928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10375.exe
        6⤵
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15959.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56077.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41219.exe
        6⤵
        
        PID:16284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41764.exe
        6⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20191.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28934.exe
        5⤵
        
        PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        5⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
        7⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
        7⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37016.exe
        7⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5407.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17378.exe
        6⤵
        
        PID:14248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        6⤵
        
        PID:17336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
        5⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45304.exe
        6⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29895.exe
        6⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
        5⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33150.exe
      4⤵
      PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        5⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        6⤵
        
        PID:11480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        6⤵
        
        PID:17180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39999.exe
        5⤵
        
        PID:9744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29669.exe
        5⤵
        
        PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
      4⤵
      PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
      4⤵
      PID:10736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
      4⤵
      PID:15168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38830.exe
      4⤵
      PID:3748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        7⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
        7⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        7⤵
        
        PID:6148
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 652
        6⤵
        Program crash
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4335.exe
        5⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42341.exe
        6⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        6⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45951.exe
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        5⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61740.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-516.exe
        5⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        6⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
        7⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49912.exe
        6⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        6⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
        5⤵
        
        PID:9040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        5⤵
        
        PID:11976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        5⤵
        
        PID:17360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
      4⤵
      PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4992.exe
        5⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
        5⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
        5⤵
        
        PID:16804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe
      4⤵
      PID:9972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6410.exe
      4⤵
      PID:14292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2457.exe
      4⤵
      PID:16924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29769.exe
      4⤵
      PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40973.exe
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-280.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36403.exe
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        6⤵
        
        PID:16868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        5⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
        5⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        5⤵
        
        PID:16980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
      4⤵
      PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        5⤵
        
        PID:11236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24395.exe
        5⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21343.exe
        5⤵
        
        PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18951.exe
      4⤵
      PID:10388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41579.exe
      4⤵
      PID:14452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe
    3⤵
    PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
      4⤵
      PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
      4⤵
      PID:11604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15767.exe
      4⤵
      PID:13436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3410.exe
    3⤵
    PID:8348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34695.exe
    3⤵
    PID:11920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
    3⤵
    PID:972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2960.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        5⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11572.exe
        6⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3242.exe
        6⤵
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        6⤵
        
        PID:17008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        5⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
        6⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
        5⤵
        
        PID:13360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14791.exe
        5⤵
        
        PID:15656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62797.exe
        5⤵
        
        PID:16548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe
      4⤵
      PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61012.exe
        5⤵
        
        PID:12812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        5⤵
        
        PID:16956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
      4⤵
      PID:9292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-162.exe
      4⤵
      PID:13920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
      4⤵
      PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
    3⤵
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64709.exe
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        5⤵
        
        PID:16844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
      4⤵
      PID:12292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60820.exe
      4⤵
      PID:16344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
      4⤵
      PID:17120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25908.exe
    3⤵
    PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
      4⤵
      PID:10356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
      4⤵
      PID:16648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45315.exe
    3⤵
    PID:9516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30175.exe
    3⤵
    PID:13632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
    3⤵
    PID:15756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
    3⤵
    PID:7692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57927.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57927.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21897.exe
        5⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2631.exe
        6⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        6⤵
        
        PID:16772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24814.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
        5⤵
        
        PID:15892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
      4⤵
      PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        5⤵
        
        PID:11196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45443.exe
        5⤵
        
        PID:15508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
        5⤵
        
        PID:16624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
      4⤵
      PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
      4⤵
      PID:12940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
      4⤵
      PID:6168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62036.exe
    3⤵
    PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41091.exe
      4⤵
      PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        5⤵
        
        PID:11432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38413.exe
        5⤵
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34658.exe
      4⤵
      PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43228.exe
      4⤵
      PID:14520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
      4⤵
      PID:17152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9902.exe
    3⤵
    PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47141.exe
      4⤵
      PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
      4⤵
      PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe
      4⤵
      PID:16444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23420.exe
    3⤵
    PID:10028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
    3⤵
    PID:15252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35322.exe
    3⤵
    PID:17216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41303.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41303.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe
    3⤵
    PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
      4⤵
      PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51401.exe
        5⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        6⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47644.exe
        5⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31026.exe
        5⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43353.exe
        5⤵
        
        PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
      4⤵
      PID:9772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
      4⤵
      PID:13856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
      4⤵
      PID:16860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61512.exe
    3⤵
    PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
      4⤵
      PID:16144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52637.exe
      4⤵
      PID:16664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61711.exe
    3⤵
    PID:9608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
    3⤵
    PID:324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
    3⤵
    PID:6716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
  2⤵
  PID:5860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26877.exe
      4⤵
      PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
      4⤵
      PID:15696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
    3⤵
    PID:10808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
    3⤵
    PID:15740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
    3⤵
    PID:5764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe
  2⤵
  PID:6220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41423.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41423.exe
  2⤵
  PID:11696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3627.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3627.exe
  2⤵
  PID:16056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59117.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59117.exe
  2⤵
  PID:5656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5508 -ip 5508
1⤵
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5524 -ip 5524
1⤵
PID:8424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5336 -ip 5336
1⤵
PID:10136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 7196 -ip 7196
1⤵
PID:13020

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1195.exe

Filesize
468KB

MD5
96690d38ecef70d67ba516d49f937241

SHA1
c83f22f487b42b471df4aef292abd279f2f1c2e2

SHA256
dcc1c4abd10c3b623d1cc266cb2677dc4a234aeddcc223dfb046e01c26061d45

SHA512
e39a04072f45494e6537171959060aa12976a2a78c01331a8ef5cd8b0e12c4842d7c154f18a466d26225a100d727524196b5dbe69f594502239b9fe32b9193c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe

Filesize
468KB

MD5
67dbfb71aa2bbf5f3fbf0def5800988e

SHA1
0426ea4315b48ac2a338abc19e4b1a1e32246325

SHA256
adec6e892bf27af7a0fb5cbfeb29cf43110b48ad213df89b220b2ca2127d38da

SHA512
856bd6aa3d25c0e6552241fe9fa4a78039002995031aa3115c38a4ff987d53a34c095ad941327cb93cf32074e43fd55fd0a60e245f4c560629ff9669ea4017b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe

Filesize
468KB

MD5
1fb0039979633ac80a2c9436a749e31a

SHA1
4184514697689a0ba999924f3e1432f443b02e10

SHA256
6659d644b9cafe0ca72aa7ab6200b1c7cff4fac8471989f704f9005d18798a37

SHA512
84940155bfb76096de218423f65cfa2c2c29971440b88d39bd29a4e0d00a34fe1bdbaeff2eebad2c15650093b705d1bfcab6031633f448273b667845b4f391da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe

Filesize
468KB

MD5
46134c638ee68fa707b5ef5017670e40

SHA1
75b30a7e081921a6259585344579d19c988e83c1

SHA256
4c5de71f06d4e6af4dee0430dc2b2db8db604fe6625b83bf050d8ff933f476ce

SHA512
97ca16f9b1ea13a274cdf66d03d4f5ec3fc0f85d8529085334aeb14c68d7405b43eff618e64b7a7bad8d0ce28e866859ada41d498e20c59ed21385348b8b118d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe

Filesize
468KB

MD5
a5f6eb930894b3b3f281b9663880d527

SHA1
f892349756715cfe17d3dfe0b38e923cde1ddc61

SHA256
c662d9b0aff3c6c6a8c5406f5b8276223e93f81f49f979407bcf31e4f4356c44

SHA512
d2ffec8075e58866151e8bf6256c6a4be01822b9e7f72e520a4f60cb00eefd19fe8efaab59e26dba8d33dc2674fa70039df0b08bd9625cd884c2e417a17cd770

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe

Filesize
468KB

MD5
7c4a8883c76661dbdffe8c6af675c828

SHA1
cc2a4aee415510c05a6cbac77f264b2d65224d66

SHA256
2bbdd046e14f3d36844553ef20ca309b1a3d8e0535fb84d0ec4d4a3388c990f5

SHA512
e1050692840092b67f608049c933c655cb43fba4c6840c6d841075e96579dde19c50aa5c008df4b643d5b3f5b90946624bdfcad26611afebc03b36883506fab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe

Filesize
468KB

MD5
8dc40450800dedb6ff663eb5379f8cd8

SHA1
a19019a4ff7ac9a1fa6c3bae34dba1b996f8932b

SHA256
71f0f308b4414f6532e63a1d80818f87c36f70bdbcee5abff63d012cf11f4a58

SHA512
f55fe1105adef6137ec24b43b548fed52d9769afc9c8162920bd5d508e7bbf8592051e2fc83ac05159d1d5f45294bb2e17aa0cc86928600f3aff100fa8ec7405

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe

Filesize
468KB

MD5
88e3c11f9d9cc2bcd7436630acb2c5d6

SHA1
adfa8cd32c55615109d5826a60d7bad36ad2f76c

SHA256
3920700b66141ad09a457cb1e948bbe52fd7c39ab3e6b1272edce26953d0610d

SHA512
262228425dac7f2e47682fab6e2b2ac1d60a9700bc59187f92c422aa18fa211e077f4b14ceb4395464af33a8ffcd90716e22ce1b080f23c259eb3a46f11f5fdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe

Filesize
468KB

MD5
beba65568679467629bea5bcee875053

SHA1
7a05afa9c5dc818a0bc3c01b7a51b0c5f1a7b0a0

SHA256
053fb189438b9e5cebe6c9b46e5e0d09e43008b7cc613f113193ce000eab8057

SHA512
93b66991af433774fd1f0b8a2b03ad74fc4ee1e451c406532fd9b459970db642dee75abdf085d98d156be0302dbcefdc4e56f4442238902d479d865362c993d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe

Filesize
468KB

MD5
a0f35bfce5fe3ce74985e6dc91c84fc3

SHA1
879883491859b137a7ce7c4cd3c35718af53355a

SHA256
02a1bb2694842fb2154c555bb215926e4038e9e5428f76e891797b4a3bddf613

SHA512
ac2b021c81c1e9a8788ca44ee6f0b8acb330414d925d7f7f6d32433be6d97ebd7128934f0aaad05724f93e593910b1280d2cf3ff10287ab14a01f9094fdc74dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe

Filesize
468KB

MD5
7a2d9fb6845ed9856803aa118b5a8eb6

SHA1
62a33a7b9073f421ffc4988dcdf3698ee30b757e

SHA256
268dce50643b988a0d269c025848ec6d7f3df8e3136db820de8791947cac2ceb

SHA512
aecd77e4574dad29850e7bf1b4633251c3f58d9dc27e9aacc3a0dd4bc6eefcdc88c47f1c41282baa0101fc89e2c6b3b59cd134ca84bb9a3df6c68bcab4a545bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32138.exe

Filesize
468KB

MD5
b8a320a63639f3830084e6811a8a4fca

SHA1
eb6e36a6aa28f5013168b159cf0269d4753ecdc4

SHA256
8c193076b6f4d295df194a0b9385e6f3df58dd611062bba511bbdd7021edcc9f

SHA512
e00b558d9583b1513a14482a84cf2422afb0703efa61e7a10c386d93802fda267c23e04bb255a33e94936183182e804ad0288be517b4433cb172937a8648e7cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe

Filesize
468KB

MD5
16aa81801ed7dc5e429deafbefd06d91

SHA1
c1348089d143b0adf2c648b18da42a04a3410d0b

SHA256
cd7a092a014dd925874d12898a5394208d058bbf03dacef722e61839baa02dc9

SHA512
6afc9f4246c7e9e863f6b0f32b10b3dd5d0f4b2d8d1b1fae2175159f02e13856eb725e0210972dc6d9e62d22c86aae5d275897f28bd6c0db560a82165630d201

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe

Filesize
468KB

MD5
e2900c958c1207a63ad91bd8bcf2c614

SHA1
9d3a7230ec2e30e03c29381145e8ac6ce8f295d3

SHA256
f71eb68269e222297ade0cc9999ee06ce1a07247d0ae17e3e12b008013f9d720

SHA512
46fc77c24bdf9bd01c7f309964d74d55d9eaac188aa833dc364a32784d03ad5731eaed599524e3111e53d59a7f30d2a6daff8e70cfda826dbed7bd76133f26a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe

Filesize
468KB

MD5
75ae42ffdce5a459f8c093c5117409c2

SHA1
0735fb908de967f92697ef4d2f3c2fae8958a279

SHA256
564956a4e2cb864e25758729d69629ba1897b588952f9a671a06cc658a6944e1

SHA512
7f70dc8a390b8846835884fe3f080c92c6e9a6b88813c261f2fbfedda61772c895b47e9f4bb350dad574372b0d2ba497ad5e77bf9238c44dd881b17545417edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe

Filesize
468KB

MD5
2e8984ba218c96b4c50bb1b55ec11b20

SHA1
dc9b75fa4f754ef77a8ecb3a0686fdbabcf5d04a

SHA256
3c467f7768177e86589a0ef4b9448b90bfa6378ae3f61ec8ac9b1ed7d607221a

SHA512
3433c71157a94b3a4d9b93682b845354e4940858a7122c16280c356d4283999bee9b7ce839a0a1a8d0be1ad06e9fed60f826cd5d3e1306a390e37a973dbc1da1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe

Filesize
468KB

MD5
a858aa67c4e15d7ab3353706b4060a96

SHA1
3d7c994e4f83b9cadd6efdd7e34405adcb8a78fd

SHA256
5264b7b5626b142314ca59584228ea404495c2ac3a0ef1ed88ebb32440f2465a

SHA512
66d53de2599d242e10209037975560fef357c564867c6b0f29276cc16e80ce3214c41e592efb4f1fcff227dc8501f3280eb26cb19cf9b8bdb19f5a32f0a63c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38025.exe

Filesize
468KB

MD5
d69a1ed62f3d819a2878d8a53cbb7250

SHA1
5f726fe021dc2b08686b6751421c31104185c5bb

SHA256
259c02483ae3da8def55f9a52d72ebb55da932d51c2aa0a68fd38269e99a3fdf

SHA512
f108d218e856654c01f77cba908805c04342af364393cbbd632cd293315586b1c1495e02b3447a86d47b6e20ca22fc38111b8582d153a88c5f2e11f65c7d3ab8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe

Filesize
468KB

MD5
9d69fc7352a285709296f47b6c611b7d

SHA1
c4541b232a0c8d19e240551862c89a9a57d342d8

SHA256
efca1ac2075167a0472d4558530e830527734dee8452224339f8ed97a92b8800

SHA512
6b0722fc58553ca28a456ce956c6daed02b5304ee7f1fbfa9136dd1d726a71a132ed1858c0b149dd1b60b52970a0da928d5ace7d1ea2913e285798571bae93d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42353.exe

Filesize
468KB

MD5
68568e9959245aea9864b488fb2339cf

SHA1
b55f0f81ad373731e0722be3f35357b1fe49b37b

SHA256
3ed5dd09910f171ae9a297a4f591f2a7b50582585fc50c7ae923a657ce8095a7

SHA512
03271b43a69cf34d519c4c74b6bf1ec9acdc95514f8a190dcf1672932917788519fa9be44095cd292e7da3a0b904c74cf21f4cba759b54ad142e13a767a555dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46224.exe

Filesize
468KB

MD5
33a6e82ef769f70ce94d23b9a2cd6154

SHA1
b4c9ae80b72f0bc33d5eebb800b33539edbb09a2

SHA256
956af00e00a069b5c540a9476025d61cc009bad915567dcb1bd4d1161f28ae0f

SHA512
b662e3fbabd2e74a9a18518b1c9957206c72a386cceea178da210e2cae982665f9132adfe5f7a70421ffb9305671347cb3c41feda7e193b527e3ff01c030daee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48232.exe

Filesize
468KB

MD5
c542fc0fe46af5cacb14610d9a4369d6

SHA1
e0379015639422c505dc25cffd8e57edfe3244bf

SHA256
c07d2030f79205a40156f2397acfe21093e14d992d15ddc30a2a31324ddaaf0f

SHA512
e5b03899461c33fd8f154815add290c144a7431d31a32c8055ef8138efaafba13e8af27774e700b560cb542d5bac51617e32af3836b450cfca899ff01a532ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe

Filesize
468KB

MD5
3fc13acbd7e616bb42e8e3c89accc327

SHA1
6641c393e588d38574178c1e4157a85dd127931e

SHA256
87d06235c36f71d9f0483f060b29dc5e8527c2991da1bd0078dcb4c46ac43968

SHA512
f86ea50d651ee2d1f7343756940eef70da177d85c59b354bd18cf146547011657bf9a55c7c23513eb0202279cd70bda66955e7d7b2aa4cf30afc404ca7becee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe

Filesize
468KB

MD5
146a40713f396034cc5ea6d459ccbc64

SHA1
d827a452e8f092a46925a0826052e66d05d1b3d4

SHA256
6ae1d8cd18f23bd80d0d5d10bb2b70530f8166a4d46591cafd085c78b8184537

SHA512
d7dca11e18dd880a12711a62bf8c9e9a1beca8443db00a17dfc9c3983f7ecafeb8644c994e19eff9839153bec019a3872763b30bb725bed839d75818871474c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5139.exe

Filesize
468KB

MD5
d13c92c1db0fc01d5c8d87bd1365f777

SHA1
372f382dce7343b0d3b6609e8ffb4cffa89fbf8a

SHA256
46073c5ebc37153ebd2b34c18e4284ac8bacaf877573b15087a110a6e2836230

SHA512
1f20f95abd3d855b96f16ce7e16e7a99a212a231114a175a4d5bca26c4c6d25c7c7b1dd16607420e469fed1ff43506b15bc6c8b43bd26a7d12f410411b1d23c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe

Filesize
468KB

MD5
9bbb50cbc0e7195f26df37abccff1ea3

SHA1
6358e5c026416f5e9cecce74f015f7594db0dd06

SHA256
43439679cc4042b6402b26014b513b4a515d005f7cc9624652d27890ae60dcc4

SHA512
f0b76c161ef4d5c32a32fa26168feca456afa5ab090d3b539433e34453314ac81cb7fb21877f1dea2b4dacbdb60704c0c071824ee733d1400c0ee43cf8fb0912

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57927.exe

Filesize
468KB

MD5
d91ae8181469df3552ac439e36a4c2ac

SHA1
a9f9092546c51004b20e454944164866ec6940c1

SHA256
f3048d9e3da4df5b6c73c278c53d268121887585fc26e1df217ab37624c2e5e4

SHA512
5997d0ffc6ddbe4df0feda644ce0dfc395e252817bdc39fb9b1d53bb901f670e1efdefb9db5d58c66826a57e53d8d51644570fddca748c10502b8f8b9f0d643d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe

Filesize
468KB

MD5
cc85cb95ef2d898ba50cddb8219416be

SHA1
f21ce35c9a1031573ca9b2b3decfed2250f41a78

SHA256
ec4f77b747ed40b85bfbf09f07cc964b4a674df86b311312b4daff41968567f6

SHA512
5f66e10db4450afbfbd4f9e28235ffe20cd25ff1f79a20e42f0d1b7ebd508cab5c4a560d6076dfa440ca5095faad6c5f1fe57e206adfce0d661be7d45ab360a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe

Filesize
468KB

MD5
d7f2701102990d16e79e96633797be01

SHA1
4acde73c5ddbbb7c715135ec68348636dad45a33

SHA256
7c6798fe59e6a4fa429878671fcf3246423390190af323493e900255f3afc729

SHA512
33b249b543988b14722c9993657126e9bfb87696871fad1078e599b7345b695fc53862dd82dbad09b84d64b6d637df13c5ea36a739ce68e52b80177262121981

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe

Filesize
468KB

MD5
d3642959f264c2291428512893d4a9c0

SHA1
feb972b2d7b633e84456b5f9f8dfeb6cb5a21d8d

SHA256
8fc5b6b3e396241f5670e393a75368e217c68ffe1dcf099c4c68e4ae80680936

SHA512
7814595dc36cf2fe1f64a05088a1ed9f395876619da0e8affe6abd5a8c547c441d3f4dd8bba7c7f074a3f112e97f604f82d225c2f7177ecb9188320e94977e57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe

Filesize
468KB

MD5
5d51ef5e7fb8888cd425f539998c20c2

SHA1
9c86652efb74ce9aa28a150e4988286ab67adc23

SHA256
c482236061ce3a6c6da7525b8be5a4193da6767eec710359c259ea11ce953d0e

SHA512
6c0fa3a060c0a0f8f8254e232b3a3bff8375e0147cf3cdce878e3d28d9977231382b1d3b69f6ce147fd4f2091766148ed66136bb598b6136c622b080b43e998c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe

Filesize
468KB

MD5
04420380459dc4cf33fad4d56950d6c8

SHA1
307b10ea8506598e04e361703ec282f6ce1bcd44

SHA256
6c05798c4633e2fad558e55d56c23bba6a6aebba3658cf907334c6828e97c925

SHA512
1ea762639c49ceeb6e355be389cdbbfdef1b180a82e9a6da06630cb5096e2b7da8657b0689ef986d743fb5ff47fae57be09099deb1efa0fdea8b7aaa7e45c333

Download Submit
memory/336-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/368-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/376-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/380-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/552-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/656-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/756-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/948-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1148-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1460-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1612-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1700-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1872-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2372-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2560-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3096-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3164-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3208-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3332-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3428-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3432-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3552-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3680-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3700-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3744-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3964-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4012-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4132-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4200-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4240-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4456-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4632-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4640-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4724-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4756-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4916-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4984-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5192-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5296-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5356-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5376-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5440-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5508-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5524-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5544-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5680-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5720-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5804-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5812-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5916-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5928-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5956-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5964-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6084-568-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14188-2707-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16152-2706-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads