a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe
Size

468KB
MD5

3382614b01329d51d416e27a42a393d0
SHA1

b81bf5d0f86cf27bdc896435382ca29757122acd
SHA256

a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632
SHA512

040afcad0c817b1ff430d3169cd9fe327ede9fcd17f84df8a354a97a6e6bf2eaeab6ac4743e46f317887445e8e3a75cef8dcc20e6c7832b26b848e1dea59bd0a
SSDEEP

3072:SqGtogUxjy8U2bY9PzsyqfU/Ekhjj+plPmHXLVICdQdGpdJNQdlU:Sq0ofLU2+Poyqf0uORdQQDJNQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3876	Unicorn-14400.exe
212	Unicorn-62615.exe
4208	Unicorn-3855.exe
4800	Unicorn-176.exe
3588	Unicorn-4260.exe
3840	Unicorn-28856.exe
3396	Unicorn-15121.exe
1444	Unicorn-43874.exe
2192	Unicorn-39525.exe
3180	Unicorn-25400.exe
3976	Unicorn-5534.exe
4988	Unicorn-5534.exe
4504	Unicorn-19269.exe
1136	Unicorn-25400.exe
2552	Unicorn-25400.exe
624	Unicorn-53194.exe
3324	Unicorn-31190.exe
4352	Unicorn-31212.exe
4732	Unicorn-50870.exe
3512	Unicorn-55716.exe
856	Unicorn-20906.exe
4484	Unicorn-20906.exe
3648	Unicorn-55716.exe
2532	Unicorn-10691.exe
3616	Unicorn-62493.exe
5064	Unicorn-20906.exe
4296	Unicorn-52187.exe
1028	Unicorn-385.exe
1984	Unicorn-20906.exe
3260	Unicorn-10334.exe
1076	Unicorn-5145.exe
2136	Unicorn-46733.exe
2296	Unicorn-3007.exe
116	Unicorn-58330.exe
2816	Unicorn-36348.exe
4912	Unicorn-34310.exe
632	Unicorn-64075.exe
2240	Unicorn-40340.exe
4520	Unicorn-60760.exe
3900	Unicorn-11559.exe
4112	Unicorn-26504.exe
4232	Unicorn-26504.exe
940	Unicorn-24479.exe
1648	Unicorn-46946.exe
2596	Unicorn-4522.exe
1100	Unicorn-59198.exe
1160	Unicorn-44808.exe
732	Unicorn-34593.exe
3328	Unicorn-32556.exe
2088	Unicorn-32556.exe
2400	Unicorn-61144.exe
5012	Unicorn-26069.exe
5100	Unicorn-6468.exe
1808	Unicorn-52976.exe
1528	Unicorn-22250.exe
4524	Unicorn-2384.exe
2528	Unicorn-13319.exe
3656	Unicorn-53531.exe
1080	Unicorn-7594.exe
2564	Unicorn-57615.exe
3444	Unicorn-34886.exe
3056	Unicorn-34886.exe
2988	Unicorn-19217.exe
2892	Unicorn-5482.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
8768	5224	WerFault.exe	289
11888	10452	WerFault.exe	491
14024	10452	WerFault.exe	491
14984	7560	WerFault.exe	362
9824	2576	WerFault.exe	835

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7594.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18268	dwm.exe
Token: SeChangeNotifyPrivilege	18268	dwm.exe
Token: 33	18268	dwm.exe
Token: SeIncBasePriorityPrivilege	18268	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe
3876	Unicorn-14400.exe
212	Unicorn-62615.exe
4208	Unicorn-3855.exe
3840	Unicorn-28856.exe
4800	Unicorn-176.exe
3588	Unicorn-4260.exe
3396	Unicorn-15121.exe
1444	Unicorn-43874.exe
2192	Unicorn-39525.exe
3976	Unicorn-5534.exe
2552	Unicorn-25400.exe
4504	Unicorn-19269.exe
4988	Unicorn-5534.exe
1136	Unicorn-25400.exe
3180	Unicorn-25400.exe
624	Unicorn-53194.exe
3324	Unicorn-31190.exe
4352	Unicorn-31212.exe
4732	Unicorn-50870.exe
856	Unicorn-20906.exe
3512	Unicorn-55716.exe
4296	Unicorn-52187.exe
3616	Unicorn-62493.exe
1984	Unicorn-20906.exe
2532	Unicorn-10691.exe
4484	Unicorn-20906.exe
5064	Unicorn-20906.exe
3260	Unicorn-10334.exe
3648	Unicorn-55716.exe
1028	Unicorn-385.exe
1076	Unicorn-5145.exe
2136	Unicorn-46733.exe
2296	Unicorn-3007.exe
116	Unicorn-58330.exe
2816	Unicorn-36348.exe
4912	Unicorn-34310.exe
632	Unicorn-64075.exe
2240	Unicorn-40340.exe
4520	Unicorn-60760.exe
4232	Unicorn-26504.exe
4112	Unicorn-26504.exe
3900	Unicorn-11559.exe
940	Unicorn-24479.exe
1648	Unicorn-46946.exe
2596	Unicorn-4522.exe
1100	Unicorn-59198.exe
1160	Unicorn-44808.exe
732	Unicorn-34593.exe
3328	Unicorn-32556.exe
1528	Unicorn-22250.exe
4524	Unicorn-2384.exe
1808	Unicorn-52976.exe
2088	Unicorn-32556.exe
5012	Unicorn-26069.exe
1080	Unicorn-7594.exe
2528	Unicorn-13319.exe
3656	Unicorn-53531.exe
5100	Unicorn-6468.exe
2400	Unicorn-61144.exe
2564	Unicorn-57615.exe
3056	Unicorn-34886.exe
2892	Unicorn-5482.exe
2988	Unicorn-19217.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 3876	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	84
PID 3736 wrote to memory of 3876	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	84
PID 3736 wrote to memory of 3876	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	84
PID 3876 wrote to memory of 212	3876	Unicorn-14400.exe	85
PID 3876 wrote to memory of 212	3876	Unicorn-14400.exe	85
PID 3876 wrote to memory of 212	3876	Unicorn-14400.exe	85
PID 3736 wrote to memory of 4208	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	86
PID 3736 wrote to memory of 4208	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	86
PID 3736 wrote to memory of 4208	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	86
PID 212 wrote to memory of 4800	212	Unicorn-62615.exe	87
PID 212 wrote to memory of 4800	212	Unicorn-62615.exe	87
PID 212 wrote to memory of 4800	212	Unicorn-62615.exe	87
PID 4208 wrote to memory of 3588	4208	Unicorn-3855.exe	88
PID 4208 wrote to memory of 3588	4208	Unicorn-3855.exe	88
PID 4208 wrote to memory of 3588	4208	Unicorn-3855.exe	88
PID 3876 wrote to memory of 3396	3876	Unicorn-14400.exe	89
PID 3876 wrote to memory of 3396	3876	Unicorn-14400.exe	89
PID 3876 wrote to memory of 3396	3876	Unicorn-14400.exe	89
PID 3736 wrote to memory of 3840	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	90
PID 3736 wrote to memory of 3840	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	90
PID 3736 wrote to memory of 3840	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	90
PID 3840 wrote to memory of 1444	3840	Unicorn-28856.exe	91
PID 3840 wrote to memory of 1444	3840	Unicorn-28856.exe	91
PID 3840 wrote to memory of 1444	3840	Unicorn-28856.exe	91
PID 3736 wrote to memory of 2192	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	92
PID 3736 wrote to memory of 2192	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	92
PID 3736 wrote to memory of 2192	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	92
PID 3588 wrote to memory of 3180	3588	Unicorn-4260.exe	93
PID 3588 wrote to memory of 3180	3588	Unicorn-4260.exe	93
PID 3588 wrote to memory of 3180	3588	Unicorn-4260.exe	93
PID 4208 wrote to memory of 3976	4208	Unicorn-3855.exe	94
PID 4208 wrote to memory of 3976	4208	Unicorn-3855.exe	94
PID 4208 wrote to memory of 3976	4208	Unicorn-3855.exe	94
PID 212 wrote to memory of 4988	212	Unicorn-62615.exe	95
PID 212 wrote to memory of 4988	212	Unicorn-62615.exe	95
PID 212 wrote to memory of 4988	212	Unicorn-62615.exe	95
PID 3876 wrote to memory of 4504	3876	Unicorn-14400.exe	96
PID 3876 wrote to memory of 4504	3876	Unicorn-14400.exe	96
PID 3876 wrote to memory of 4504	3876	Unicorn-14400.exe	96
PID 4800 wrote to memory of 1136	4800	Unicorn-176.exe	97
PID 4800 wrote to memory of 1136	4800	Unicorn-176.exe	97
PID 4800 wrote to memory of 1136	4800	Unicorn-176.exe	97
PID 3396 wrote to memory of 2552	3396	Unicorn-15121.exe	98
PID 3396 wrote to memory of 2552	3396	Unicorn-15121.exe	98
PID 3396 wrote to memory of 2552	3396	Unicorn-15121.exe	98
PID 1444 wrote to memory of 624	1444	Unicorn-43874.exe	101
PID 1444 wrote to memory of 624	1444	Unicorn-43874.exe	101
PID 1444 wrote to memory of 624	1444	Unicorn-43874.exe	101
PID 3840 wrote to memory of 3324	3840	Unicorn-28856.exe	102
PID 3840 wrote to memory of 3324	3840	Unicorn-28856.exe	102
PID 3840 wrote to memory of 3324	3840	Unicorn-28856.exe	102
PID 2192 wrote to memory of 4352	2192	Unicorn-39525.exe	105
PID 2192 wrote to memory of 4352	2192	Unicorn-39525.exe	105
PID 2192 wrote to memory of 4352	2192	Unicorn-39525.exe	105
PID 3736 wrote to memory of 4732	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	106
PID 3736 wrote to memory of 4732	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	106
PID 3736 wrote to memory of 4732	3736	a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe	106
PID 4988 wrote to memory of 3512	4988	Unicorn-5534.exe	107
PID 4988 wrote to memory of 3512	4988	Unicorn-5534.exe	107
PID 4988 wrote to memory of 3512	4988	Unicorn-5534.exe	107
PID 4504 wrote to memory of 856	4504	Unicorn-19269.exe	109
PID 4504 wrote to memory of 856	4504	Unicorn-19269.exe	109
PID 4504 wrote to memory of 856	4504	Unicorn-19269.exe	109
PID 3976 wrote to memory of 4484	3976	Unicorn-5534.exe	110

C:\Users\Admin\AppData\Local\Temp\a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe
"C:\Users\Admin\AppData\Local\Temp\a27173d5609f14a21b59e6685b488e1597e995705632a82f4357ab2eea5a8632N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-176.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21840.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe
        9⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        10⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        10⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        9⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5368.exe
        8⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29172.exe
        9⤵
        
        PID:17520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        8⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        8⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
        8⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
        9⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        9⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        9⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
        8⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        8⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5389.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1383.exe
        9⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
        9⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        8⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        8⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        7⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
        7⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2384.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53630.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe
        9⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        10⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        9⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36110.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:18052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
        8⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        8⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        8⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        8⤵
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe
        7⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        7⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9836.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
        7⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        7⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21574.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        6⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36348.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16988.exe
        6⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        9⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        9⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35622.exe
        8⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
        8⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        8⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        8⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        7⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        7⤵
        
        PID:16608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4320.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3345.exe
        8⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
        7⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        7⤵
        
        PID:16656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        6⤵
        
        PID:14472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57563.exe
        5⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59328.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        8⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        8⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        8⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        7⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        7⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
        6⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        7⤵
        
        PID:18224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
        6⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        6⤵
        
        PID:17304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1881.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
        6⤵
        
        PID:17988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54745.exe
        5⤵
        
        PID:9532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
        5⤵
        
        PID:14424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34483.exe
        5⤵
        
        PID:11220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5534.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55716.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26116.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29370.exe
        8⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        9⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        9⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        8⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        9⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
        9⤵
        
        PID:18628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        8⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24269.exe
        8⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16903.exe
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50859.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        7⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15826.exe
        8⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        8⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12181.exe
        8⤵
        
        PID:17536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21424.exe
        7⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
        7⤵
        
        PID:16336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        6⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        7⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        7⤵
        
        PID:16748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44315.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        6⤵
        
        PID:16592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6468.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        7⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25810.exe
        8⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22166.exe
        8⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3629.exe
        8⤵
        
        PID:17096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33702.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        7⤵
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34968.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62758.exe
        7⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        7⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        6⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
        6⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7095.exe
        5⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
        6⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7560 -s 676
        7⤵
        Program crash
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24765.exe
        6⤵
        
        PID:13344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        6⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        5⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24342.exe
        6⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25317.exe
        5⤵
        
        PID:12924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64605.exe
        5⤵
        
        PID:17484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        5⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9141.exe
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24440.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        8⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        7⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        7⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37594.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
        7⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
        7⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9643.exe
        6⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
        6⤵
        
        PID:16740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28270.exe
        6⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        6⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        5⤵
        
        PID:11196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39842.exe
        6⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe
        7⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32104.exe
        7⤵
        
        PID:15544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        6⤵
        
        PID:10920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe
        6⤵
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21128.exe
        5⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        6⤵
        
        PID:11208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36888.exe
        5⤵
        
        PID:11616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        5⤵
        
        PID:16888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28799.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        5⤵
        
        PID:15116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31994.exe
      4⤵
      PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60698.exe
        5⤵
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        5⤵
        
        PID:17612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
      4⤵
      PID:12740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
      4⤵
      PID:4276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42260.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47818.exe
        8⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        9⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
        9⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21424.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        9⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        9⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
        8⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57693.exe
        7⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
        8⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        8⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41383.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        7⤵
        
        PID:16468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46448.exe
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        8⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
        7⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        7⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22995.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56064.exe
        7⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26225.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19303.exe
        6⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57615.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22224.exe
        6⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        8⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26288.exe
        9⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        8⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56619.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        7⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe
        6⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54995.exe
        6⤵
        
        PID:17272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53582.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
        6⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18706.exe
        7⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        7⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        6⤵
        
        PID:13572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        6⤵
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25317.exe
        5⤵
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64605.exe
        5⤵
        
        PID:17588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52187.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11559.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        6⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13225.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31485.exe
        8⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50859.exe
        8⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
        8⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        7⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        7⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24440.exe
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54300.exe
        8⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        7⤵
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        6⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10452 -s 464
        7⤵
        Program crash
        
        PID:11888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10452 -s 464
        7⤵
        Program crash
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe
        6⤵
        
        PID:17164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65181.exe
        5⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        6⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58996.exe
        8⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        8⤵
        
        PID:13376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15113.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25404.exe
        6⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        7⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        7⤵
        
        PID:16996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5585.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17662.exe
        6⤵
        
        PID:16528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64656.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        6⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        5⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
        5⤵
        
        PID:17528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24479.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35846.exe
        5⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58918.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24765.exe
        7⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
        7⤵
        
        PID:17352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1030.exe
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        6⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 464
        7⤵
        Program crash
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        5⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35160.exe
        5⤵
        
        PID:10500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37315.exe
        5⤵
        
        PID:15716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64169.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        5⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30216.exe
        6⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        6⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5419.exe
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
        5⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        5⤵
        
        PID:14608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61856.exe
      4⤵
      PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65026.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        5⤵
        
        PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54745.exe
      4⤵
      PID:9544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
      4⤵
      PID:15160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24369.exe
      4⤵
      PID:11240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60760.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
        6⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32058.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        9⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5462.exe
        9⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
        8⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
        8⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
        7⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49432.exe
        8⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35394.exe
        8⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        7⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        7⤵
        
        PID:16160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24440.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
        8⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        8⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        7⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6151.exe
        7⤵
        
        PID:17200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        6⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28649.exe
        6⤵
        
        PID:15736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63235.exe
        5⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        7⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39079.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51400.exe
        6⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe
        5⤵
        
        PID:13380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15425.exe
        5⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33070.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40226.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49432.exe
        8⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe
        8⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
        7⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
        7⤵
        
        PID:17368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26825.exe
        6⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41010.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        7⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        6⤵
        
        PID:16852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12125.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17714.exe
        6⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37135.exe
        5⤵
        
        PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
      4⤵
      PID:820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33070.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
        6⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5711.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        7⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        6⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        5⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49432.exe
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39452.exe
        6⤵
        
        PID:18660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49908.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        5⤵
        
        PID:18472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33573.exe
      4⤵
      PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40200.exe
        5⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        6⤵
        
        PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        5⤵
        
        PID:16880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
      4⤵
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
      4⤵
      PID:13436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24170.exe
        5⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30112.exe
        6⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        7⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        7⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe
        6⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        6⤵
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe
        5⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11051.exe
        6⤵
        
        PID:13436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        6⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
        6⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32437.exe
        5⤵
        
        PID:17064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
      4⤵
      PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26386.exe
        5⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        5⤵
        
        PID:14344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10873.exe
      4⤵
      PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
      4⤵
      PID:14500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59568.exe
      4⤵
      PID:13568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        5⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56448.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        6⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        5⤵
        
        PID:11184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
      4⤵
      PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        5⤵
        
        PID:16680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
      4⤵
      PID:11808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
      4⤵
      PID:16664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49020.exe
    3⤵
    PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
      4⤵
      PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27018.exe
      4⤵
      PID:13984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
      4⤵
      PID:17404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43414.exe
    3⤵
    PID:8496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
    3⤵
    PID:6420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4260.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55716.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48290.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61632.exe
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18540.exe
        9⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
        9⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56235.exe
        8⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15305.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38834.exe
        7⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11933.exe
        8⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64533.exe
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe
        7⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46899.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        9⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9354.exe
        8⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46915.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
        7⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
        7⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe
        6⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30470.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
        8⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe
        8⤵
        
        PID:17424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27428.exe
        7⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        7⤵
        
        PID:16928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62018.exe
        6⤵
        
        PID:18096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28254.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56448.exe
        8⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        8⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        7⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        6⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
        7⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        7⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17662.exe
        6⤵
        
        PID:16508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2819.exe
        5⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28270.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        6⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
        5⤵
        
        PID:14332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59198.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        6⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21202.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18244.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32104.exe
        9⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
        8⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4061.exe
        8⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        8⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22689.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        7⤵
        
        PID:14328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        6⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10345.exe
        8⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
        8⤵
        
        PID:17464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
        7⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44149.exe
        6⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9738.exe
        7⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53313.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7060.exe
        7⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        7⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        6⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
        7⤵
        
        PID:16584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        6⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47745.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1627.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32359.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
        5⤵
        
        PID:15588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
        7⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        8⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        8⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
        7⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        7⤵
        
        PID:17340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe
        6⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17714.exe
        6⤵
        
        PID:15724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41025.exe
        5⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        5⤵
        
        PID:15612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34019.exe
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61632.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28270.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        6⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        5⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25328.exe
        6⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
        5⤵
        
        PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
      4⤵
      PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        5⤵
        
        PID:11008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        5⤵
        
        PID:14448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42850.exe
      4⤵
      PID:11332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
      4⤵
      PID:14436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5534.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
        6⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59712.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        8⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        8⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        8⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35648.exe
        7⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        7⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42944.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        7⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35378.exe
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        6⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
        6⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26670.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32764.exe
        7⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        7⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        6⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52525.exe
        7⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49759.exe
        6⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7060.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
        6⤵
        
        PID:14440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        6⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
        5⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10168.exe
        5⤵
        
        PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
        5⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17092.exe
        6⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 636
        7⤵
        Program crash
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19207.exe
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe
        6⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57693.exe
        5⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61710.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11684.exe
        6⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14740.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        5⤵
        
        PID:16860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1511.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
        5⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        6⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
        5⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16714.exe
        6⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
        5⤵
        
        PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
      4⤵
      PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        5⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3116.exe
        5⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        5⤵
        
        PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3797.exe
      4⤵
      PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21574.exe
      4⤵
      PID:14284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe
      4⤵
      PID:17028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-385.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28446.exe
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46619.exe
        5⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38798.exe
        6⤵
        
        PID:18708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45370.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14610.exe
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        5⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe
        6⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55554.exe
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        5⤵
        
        PID:18308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
      4⤵
      PID:12660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7435.exe
      4⤵
      PID:16776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
      4⤵
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51539.exe
        6⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe
        5⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
        5⤵
        
        PID:17152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2705.exe
      4⤵
      PID:8784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
      4⤵
      PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
      4⤵
      PID:1220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19.exe
    3⤵
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
      4⤵
      PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2514.exe
      4⤵
      PID:13964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
      4⤵
      PID:16696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
    3⤵
    PID:9256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38640.exe
    3⤵
    PID:14272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
    3⤵
    PID:15780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43874.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34886.exe
        6⤵
        Executes dropped EXE
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54896.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        8⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45348.exe
        9⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43536.exe
        9⤵
        
        PID:18740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        8⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7435.exe
        8⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38834.exe
        7⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43428.exe
        8⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17069.exe
        7⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        7⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        8⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
        8⤵
        
        PID:17472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        7⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        7⤵
        
        PID:17560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44760.exe
        6⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        7⤵
        
        PID:588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
        6⤵
        
        PID:13096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        6⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5482.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28254.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19012.exe
        7⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        7⤵
        
        PID:18452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17812.exe
        6⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27969.exe
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6903.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54035.exe
        6⤵
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16738.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe
        5⤵
        
        PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34886.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1611.exe
        6⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54616.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5711.exe
        8⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        8⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        7⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58284.exe
        7⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5176.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16198.exe
        6⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36146.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17642.exe
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe
        6⤵
        
        PID:14544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        5⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
        6⤵
        
        PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
        5⤵
        
        PID:16900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19217.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24170.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe
        6⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3459.exe
        7⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51285.exe
        7⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54200.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        5⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
        6⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        6⤵
        
        PID:15756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24443.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18046.exe
        5⤵
        
        PID:17440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
      4⤵
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61829.exe
        5⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
        5⤵
        
        PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21574.exe
      4⤵
      PID:14356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21203.exe
      4⤵
      PID:14780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3007.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
        5⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe
        6⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31485.exe
        7⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50859.exe
        7⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45370.exe
        7⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe
        6⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
        7⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20359.exe
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24269.exe
        6⤵
        
        PID:17504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51113.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        6⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        6⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        5⤵
        
        PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59568.exe
        5⤵
        
        PID:14996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe
        5⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        6⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13879.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5576.exe
        7⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30463.exe
        7⤵
        
        PID:16348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        6⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe
        6⤵
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16760.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        6⤵
        
        PID:18204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52648.exe
        5⤵
        
        PID:11388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28327.exe
        5⤵
        
        PID:16984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64848.exe
      4⤵
      PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        6⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        5⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        5⤵
        
        PID:18068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
      4⤵
      PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38109.exe
      4⤵
      PID:14516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4138.exe
      4⤵
      PID:14560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2789.exe
      4⤵
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9779.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        6⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        6⤵
        
        PID:11360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        6⤵
        
        PID:16756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        5⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
        6⤵
        
        PID:17432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        5⤵
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exe
        5⤵
        
        PID:17112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
      4⤵
      PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        5⤵
        
        PID:13936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        5⤵
        
        PID:17388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
      4⤵
      PID:8840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
      4⤵
      PID:14332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
      4⤵
      PID:13952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31113.exe
    3⤵
    PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
        5⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49432.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
        6⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28117.exe
        5⤵
        
        PID:13020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        5⤵
        
        PID:16804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe
      4⤵
      PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47770.exe
      4⤵
      PID:12856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27969.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
    3⤵
    PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
      4⤵
      PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55431.exe
        5⤵
        
        PID:18248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33842.exe
      4⤵
      PID:12928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
      4⤵
      PID:16732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34260.exe
    3⤵
    PID:8400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
    3⤵
    PID:852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40340.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39354.exe
        5⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36526.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        8⤵
        
        PID:17576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24714.exe
        7⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22461.exe
        7⤵
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40449.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        6⤵
        
        PID:14304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
        6⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
        6⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49411.exe
        5⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21561.exe
        5⤵
        
        PID:19116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9950.exe
      4⤵
      PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59328.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8923.exe
        6⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
        7⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21424.exe
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43894.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63147.exe
        5⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2514.exe
        6⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58512.exe
        5⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23142.exe
        6⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
        5⤵
        
        PID:13772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
      4⤵
      PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe
        5⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        6⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
        5⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        5⤵
        
        PID:17192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58793.exe
      4⤵
      PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
        5⤵
        
        PID:14156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        5⤵
        
        PID:17872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25317.exe
      4⤵
      PID:12832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
      4⤵
      PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe
      4⤵
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27092.exe
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        6⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32061.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        5⤵
        
        PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12026.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8513.exe
        5⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8591.exe
        6⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        6⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57387.exe
        5⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24599.exe
        5⤵
        
        PID:16896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
      4⤵
      PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe
      4⤵
      PID:12712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
      4⤵
      PID:16764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
    3⤵
    PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
      4⤵
      PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        5⤵
        
        PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        5⤵
        
        PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
      4⤵
      PID:9272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
      4⤵
      PID:14960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
    3⤵
    PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
      4⤵
      PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe
        5⤵
        
        PID:13332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
      4⤵
      PID:13420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
    3⤵
    PID:9428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4061.exe
      4⤵
      PID:14032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
      4⤵
      PID:15648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
    3⤵
    PID:14364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56014.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45576.exe
      4⤵
      PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe
        5⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe
        6⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        7⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exe
        7⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
        6⤵
        
        PID:15704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        5⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
        6⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51086.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27969.exe
        5⤵
        
        PID:16484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8247.exe
      4⤵
      PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        5⤵
        
        PID:14120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        5⤵
        
        PID:14568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
      4⤵
      PID:9980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10168.exe
      4⤵
      PID:15624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42046.exe
    3⤵
    PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51160.exe
      4⤵
      PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2244.exe
        5⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        6⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16275.exe
        5⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54611.exe
        5⤵
        
        PID:16564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38808.exe
      4⤵
      PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        5⤵
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
      4⤵
      PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54995.exe
      4⤵
      PID:17216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13920.exe
    3⤵
    PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
      4⤵
      PID:10340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
      4⤵
      PID:13952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
      4⤵
      PID:17020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
    3⤵
    PID:10092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe
    3⤵
    PID:15172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59112.exe
    3⤵
    PID:16948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
    3⤵
    PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2461.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        5⤵
        
        PID:18300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
      4⤵
      PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        5⤵
        
        PID:18212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65399.exe
      4⤵
      PID:15556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58705.exe
    3⤵
    PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
      4⤵
      PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60698.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
        5⤵
        
        PID:9156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
      4⤵
      PID:11464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
      4⤵
      PID:17316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
    3⤵
    PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19500.exe
      4⤵
      PID:12092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
      4⤵
      PID:16644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20386.exe
    3⤵
    PID:12608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
    3⤵
    PID:16828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
    3⤵
    PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55747.exe
      4⤵
      PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        5⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
      4⤵
      PID:12136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
      4⤵
      PID:17204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51471.exe
    3⤵
    PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18120.exe
      4⤵
      PID:17328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe
    3⤵
    PID:7288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
      4⤵
      PID:16908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
    3⤵
    PID:13956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
    3⤵
    PID:14512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
  2⤵
  PID:9004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15974.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15974.exe
  2⤵
  PID:14396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
  2⤵
  PID:15492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5224 -ip 5224
1⤵
PID:9408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 10452 -ip 10452
1⤵
PID:10696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 10452 -ip 10452
1⤵
PID:13876

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18268

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:9144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe

Filesize
468KB

MD5
07efa79fa7d294bfe72a347ab3351863

SHA1
52ad1dd88dc36cf4ca6b761f110cdd745dc716ff

SHA256
1d21311273796d9768c5082f26bcddd6b697eb4c8ec8585c2c3855f44e48d838

SHA512
e05adcb5bb425f640f72a42573dcea9a78bdc7b1aab0c6105aef59fe740f3757ab147edd81438bd19204caed09aea74e0e36fb2e8f3a1fc6d8b6dec6db4ac9db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10691.exe

Filesize
468KB

MD5
7e431c415ae5412c58e1de08dc827770

SHA1
b2fda7278e11c4f08c68079d79c5ee999956b7b8

SHA256
7d2c042f452d39d268d4342af028ea45e3b82f86054110c91c549915b5ff1f69

SHA512
9f46c903e4609b3820ab8a34e0ee73c64a6b9b1f5b47183655a96a1d580af1b34c6f98f9d5b09d6fb728664852b75ba59e84e79db870ecc3487f90c3c73338c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe

Filesize
468KB

MD5
4ce6df8c848f8be96276fc90e33c038c

SHA1
4fc017d83a0179438fe08aeb9254548112cb353c

SHA256
2fe238f93ea67b56f390ef2dec37451f639e4f48802c53553e56d4526ffe5b15

SHA512
9fe59bd328187fcb2bd6b5d3de46f9700878ada6fe69357151070ca284c382351fe903575fd2389da9cb56a948af3045c2868ea5ce4110fc2672b483492c8baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe

Filesize
468KB

MD5
daf094f1953eedf97cf5549566442642

SHA1
ff55b01d37d8790272afa152a9c52c8f75bbf2f7

SHA256
6cd33cc4c0d3f2d7c5f621df1e2562e85d52d62267adb4d265dcc83f33300aec

SHA512
a0224c3c9d3f3eb47ec7662b3ca83acca44e37fd1c63bcb26f7bedfb41ddd97fa8da523c026ac78272a6903134efc58bac953c066f6160c8bad9a741a1d7e663

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-176.exe

Filesize
468KB

MD5
735938681acc10c5c75f9cf350a156d5

SHA1
e184997763349dacd38e81019ee083d636b96c6a

SHA256
4d6ce6b3b6c313f3353ba19f52661e0100f3903d4f493ddd29dcef9da2c2e4e2

SHA512
5a03d8105787d1819ca2e212ac0569dc33234ad2c652c57955dfb0bca6a0fa8b445701b1f9ea98b1c21194393b73775d1ab26077c2a0c64ca3d60e762efbebb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe

Filesize
468KB

MD5
3527c7e8669426ced074048e03a6f10c

SHA1
1bd999ef53485d4e0cdd5433313b15fe4cd39c4e

SHA256
9adfc17d901c40134eb508df4da2a03fc12d0f38b33c091a2050ada94514a59c

SHA512
a8afe6162768555b0f387fbc35a39d88499c8c1cc5f4747852f3bdd4029d50c0ccf1414acf51d1f70450d017c05efa1676e607b6b0bee0d33b16f5f2fa94fc66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe

Filesize
468KB

MD5
5a77d0b9481c9dc9069379953c5de78f

SHA1
941e105467e83e9ca50bbf70eb364b0bf7754c86

SHA256
dac3e6acb33f29d8e7bf3ed94238229c3d92aa1cab2c92b79efe45035d58f027

SHA512
475125caae8e6942378cff311b8a3946bc2e4c8cee08732b6cfe696c304a30a0ece8347a88412a536c4daa643608ab064ee021f3b68f6858e4155b5984278a2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25400.exe

Filesize
468KB

MD5
5094cad690036d0caafd37d3cf4a1341

SHA1
4426c4071f01c19f7d283d01c1ea6fefa6f7b011

SHA256
e8ac0d741b7e3539d34bb3faddc62040fbeb96b94946e1a063354c103b7ca510

SHA512
7f782f77f3c1c738999012d91718e650081b2fedf38a6f0045e7295d57a575eba58c022efde764cc26e45647d5e5b273bf1faa226fc8d292e3695f54517a88ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe

Filesize
468KB

MD5
aa1f3340b104e7e62edecfa92ca0692b

SHA1
63d06fd2db858b9b69aaf3a5b8b9be6d3dba9952

SHA256
57e1217405b9c151c65ea7f56d255c7c820a6c49c2d2f51a21756fdb7e3f41f1

SHA512
39b8e7621df70616891da1c1ccdae4513167acfd2cb8fde47bae48baaf4aa2df2ea4c11f4c7b1f1296614748fe52930d8ab21634995115ee080b536769b8ab9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3007.exe

Filesize
468KB

MD5
1dd6b54713f0b562bd35bf0932500e2c

SHA1
f82c1e71ba961680c5a3c4488b9f8144bf0aee76

SHA256
d59c058de860fc5298f86999ca78e4803caaa017919c2dfbae9a8b121df64a0c

SHA512
62ec50946036969b204f35fcb6f4e180b5c0e423eefe3a7041e6bb26b1c7955e1f0322cf5f26c3158b23f679e032712626f788331392cc96f1c25cae4a5ee71c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe

Filesize
468KB

MD5
30098887ef1cc7dd4b0a414edb2be574

SHA1
7b8c99808fe1f4dcfc806587331836a0d26fe345

SHA256
47d5838ae3932cc13dbfda7f5e13e6ad8ed6708d62d789a6595e9cf24a39272c

SHA512
f864ee91ad5ee64b7c46409311edbcafe7d55cc9507a2f189aae859cdfefd1bd43c1aaea28c1ab96d448e315b37a2ed28303e27bec4879676798fcd0f82682d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe

Filesize
468KB

MD5
07095fe39fc68844c4c89e3fb338ddad

SHA1
fc2aa293cfcba7587ece1ca95494db7582ceb3fa

SHA256
89fee8ea80d0481806e875feacda5ecec45b7738f7e776b460b7d7559536894e

SHA512
8b5a6b266dda08f5c4caab92488cd6bbdcc10c94748a86d7eda641387909a619edc4c951ba1c296737a9b4bb33ef000441cb0abcebbd5f4f4acd2dbae8e35cce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe

Filesize
468KB

MD5
3119e3cfd89646794d31d09941401cd5

SHA1
e4d8e0262ecc92e56438611321d99206f5de975e

SHA256
ccc86057fda980e17a2e6191ddd2556e4a6327ab7ac177728ab5b296e9f50fa3

SHA512
a86811a432265cb1160447ad397334908a77d7d9d704690b9baef17b87cdfb3a8c4477afa2f735dafcac0878f79cd12313f503e083c9060be3b196641160d04c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36348.exe

Filesize
468KB

MD5
dc85efc182b7bc0ac7aaa5e264fe4301

SHA1
fba5467fd9efe249f4c441f96d0de819e2e90980

SHA256
f11f0702dd8e9dc157ad275bd2e1f175e764c629f09c654af8fbe0b0cc79bc14

SHA512
e504a8e200cfaf8edc7d0e1ae190caede8a5b1e4aec3321f1cdc4d139f65d3ec39335e7c82f8e2cd23afacffb0c83f511919b295e2ea8ea700c01c7a07dd8b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-385.exe

Filesize
468KB

MD5
2259a32e720f063fcc02fa033b4ebde8

SHA1
122ab9ab88ddd0b6e8f867b8998b88ab5ad1ddd1

SHA256
8dc16b3cad10697b004070df98100f06faa34d202129bcd673ef17f2f47807e9

SHA512
e309c908243a68a1b63d14f14c75085dd48b1878e56a671073ded9b87a8b057689baa0cb6508982cb6efa52e18fa65789b9581c3bad5570b44503ee56dab3853

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe

Filesize
468KB

MD5
89fb3055d7e7990f8570549d6012de7c

SHA1
b63a37d40b1e5cf5190c8e00dcb707540803cae1

SHA256
a7025acd3ad4220c3b443f4c760ea01201165ab9168b4ba9b7132bd83155c134

SHA512
7732a5009db215abf28be9342daf09b800e070f9471aa53ab1f7f6237de38e7a24d4a761aa6a367053a9f2b3b44d12114fc625e0f562839b07bbc865f4e173ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe

Filesize
468KB

MD5
b11a39bfef28361c8addd6cb5a593edd

SHA1
7634bb902ef343d3e112053b7b8545f27e0d55c2

SHA256
a9b0b5e0e22059486d8167588bdab85685b22207dec443019284c9e6cc6d3321

SHA512
047749a50f1bfb8799b2849d79baa7461f5f4cc49186e93d5524df2d02766bbeeea984bf42a7148b4e92ee2cc5ec95181ee316674ba551095ddb0d22148143db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4260.exe

Filesize
468KB

MD5
9b729da474236e275eda904149df6c5f

SHA1
4ebf548f1006903f4fba045c129de8b42a9c6f1e

SHA256
a05a388c785e7c8708482500ca6125a3ec780fd48c1e451137c8d4f7d9425038

SHA512
69a3b49cf5947c7c6f1d3f3194f3b06d733d276db8a16219ce1bebb1a06af6608eec416c917efef99a2688d4495ebb3fa6c21b77cba801694a07613a79ba36b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43874.exe

Filesize
468KB

MD5
26f1f6fa4be5f37deb684d4365bb1270

SHA1
effd3017147bcffd8cebd176c9ea82a0c83b3afb

SHA256
1aed65d4ea1e0ed1d9f4b74f035625569f09320865754830d2c3bb3895d4994e

SHA512
e816b430a03fe1bdf5600976d14626b701193d3ca39f8ff947decb006897aa7250e1b8cf86d58fcb762ad8d338d94ae75654a395f3358cdba4e16f5cd9a08e89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46733.exe

Filesize
468KB

MD5
4e3b6856d47c4b49b3ce2a29f2f59ca5

SHA1
ecec2b64e67e12fa34f14c1db3ac8be129a0bb01

SHA256
8a81102c83dac231590ecb440054b55be684bc930d593ad75c7dae2e6a46f7f2

SHA512
9d92ca8b8b9ec215b9a7ea138d108a16619370c19b4a5e5f08d3b834b4444b085fd3f87cb9712060f4afa5121c25d7dbc0cf8f563f824badd534a9b21eef0255

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exe

Filesize
468KB

MD5
8b830c248a4cedf7555e4382a38304f6

SHA1
74be4c757b2f4f39bcc8976e2250ece1ad18544e

SHA256
e1a4bef6dd94ebc78a6ac74d7b2422c7cb98803e05b3a3026809b2a1f92cce30

SHA512
3cef610c10cf08d2f051eeac1d0029cf2e28189a34ac77ffe53346602bba918b245bee072db631e6ca44fcbb2c7f1ec44a50a2d8998caa4ef7202fa43e966c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe

Filesize
468KB

MD5
68e6c5f7af328207cfb964c25c25a098

SHA1
978d56c2dbfeff9eef98a150884ed291895ca9e3

SHA256
2456f3eeef2f1fc0cc17bec54ecf8fae4561aa99bcaa0072665e44433b47b3d5

SHA512
16e8d86336b43ecc75f21329c59254dc4ec1cd487b3bb4c92d6a157a159daade7282a083248dc14cf1253d9db00899a80173b9ce38396306563838d444ef1cdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52187.exe

Filesize
468KB

MD5
d95e9f1cf6cfdf0a5ede2f8325062275

SHA1
b150bcd5efd2ad6182dec7975422c047cfd74724

SHA256
350071368b19c09b10e86652b3f77d72561d0679a6ff74462145868b43738ded

SHA512
641b15a128c4a11ca3ef8de2837653c7ecf35b10f3eb0dee260618c87e187c70fb7438cd666c34180adc0780dcb6bc663e051a11f0f1b54addddc4c28737da84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe

Filesize
468KB

MD5
8c1a7a3ccc527f2a118927f381b36019

SHA1
6a620ef2f927200528cb1ca139640a7e2b37ebd1

SHA256
49b06c07cebf1dd1989ac509ec4da9449fefe78a4b2b9ff35a2e677424c6327c

SHA512
ea374739fdc96eb3b6dd36f47b5cf04a08048f3c1aea0030be64f944b8570d14fd70c7e92aead7b3c1beccec97cc6134f7ad8630cd34b6db74f5a9c087f735c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5534.exe

Filesize
468KB

MD5
9de33f49916da572fe76032e8b26c309

SHA1
6ff1e8407a16aec70b130a16efbcf73e5ab535cb

SHA256
a2e4e8bfcbb853459c025bb56b21da642d43847a1fe4dfdc86eb1dcd848de5e5

SHA512
42fe03fcf83d3bc0a0355d27d5f7b26bcc767051024e32066ceb9ecae82e60ced8cafef9c865d74db1b810241559839786fdab36b85722f2d3f91af4a106e43f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55716.exe

Filesize
468KB

MD5
a4072d1f270fb6f6b18828515b9c388f

SHA1
dc16e156fd83f130f582a03a5229d0ac7a195a7d

SHA256
d8049a3abd2ffd243084735c6a7a50cd47126079988b1239b06a186bbd178ffa

SHA512
ba6dbc36da1c65954b20a1f8cb57387cd3d0f4e6c5fead40d5573b5d3c7070f1c78594913659e7da18e9b078dcd498a0c8a8aa43968f9d2e5abafa3b7ffb061b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe

Filesize
468KB

MD5
4f7411418cfd61593536475a2b8e40a3

SHA1
78624838baa747f5dab6bf63f0586f7f6a78b5e2

SHA256
a3d201c7883c1287fc960fb7437f7b33ac396c6e914eebda8f1be0f194848a6c

SHA512
e0b3ee870ad56d0ebcca78c5419178ba15340fa9722a8b36ee5799835caf13bffc04dface0a990d3d5bc5b2fe63fee7da5ee1388c5e7dc89da1d225b72682d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe

Filesize
468KB

MD5
0be2a2e7a47cb2b806a02f6eb3a0f33b

SHA1
15a97badd0937b6fc5c450c14db1397aed793d76

SHA256
021d9d5cf5b77e9404ec4c7fecbb0c56e967bf5efb77fb3e6a1b3db722f3e9fb

SHA512
3090d8f49d4d320fc8a12e97eefd13b54d671c887cce9739a8de4d1ef3af7626856922b3d10557f778ec0f771e0b6d9b68f90a3450d64a1ad002e9c7d783e7d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe

Filesize
468KB

MD5
4fef5e9f410a7b66fb4ca623e6e9b422

SHA1
ce856f4b091d5f4056843f096d0baec4e3ed1754

SHA256
c61ee5bb1960efc9fba9c297fe50013dc29f5d4b909678d8a7c4f94d110c18a5

SHA512
1615641b3ae8786e0d07eadd41b13991b92dc3666fc6fda974233976013d5e588742c2d468b6abceeda750fff7cc8ebcfdfa952dabf4920d0c7594a79460862e

Download Submit
memory/116-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/212-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/620-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/624-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/732-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/820-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/848-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/856-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/940-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1028-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1076-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1080-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1100-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1144-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1188-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1648-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1808-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2528-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3032-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3132-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3180-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3188-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3260-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3324-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3328-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3368-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3396-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3404-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3444-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3512-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3616-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3648-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3656-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3736-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3836-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3840-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3876-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3900-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4112-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4208-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4256-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4504-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4524-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4776-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4800-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4800-2369-0x0000000074EE0000-0x0000000074FBB000-memory.dmp

Filesize
876KB

Download
memory/4804-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5244-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5260-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5316-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5356-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5400-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5412-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5512-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5536-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5608-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5636-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5792-885-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5860-894-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5876-895-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14156-2365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14492-2370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14516-2371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14844-2418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15160-2419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15220-2420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads