4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe
Size

468KB
MD5

178acb02195d74a61e3bbab7ab6f1995
SHA1

d976b391c5de5729e6edb4ecc977a3dd48d49977
SHA256

4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19
SHA512

340f8b344c25ce7cacb0b34279aa74e46d072129923dd35e0f6c68e1cbc118aee516165d8196259ef7042a8c202cbb5c0c955b5e91fc61133ead449d798702a7
SSDEEP

3072:dF9aogBRj/8U2bYnPz3yqf8/oCbryIplPmHxoTHZZp++hSBNBGlI:dFUoiEU28PDyqf10ckZpZkBNB

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1760	Unicorn-16910.exe
2456	Unicorn-46650.exe
5080	Unicorn-34952.exe
2484	Unicorn-40270.exe
3872	Unicorn-26626.exe
1564	Unicorn-46492.exe
4472	Unicorn-48530.exe
5112	Unicorn-16726.exe
2412	Unicorn-20810.exe
4748	Unicorn-24793.exe
4688	Unicorn-30924.exe
4392	Unicorn-11058.exe
2764	Unicorn-30924.exe
1532	Unicorn-49953.exe
3840	Unicorn-4016.exe
4740	Unicorn-15740.exe
468	Unicorn-53819.exe
796	Unicorn-6009.exe
3352	Unicorn-14269.exe
4336	Unicorn-57156.exe
3160	Unicorn-5552.exe
2752	Unicorn-55018.exe
4984	Unicorn-55018.exe
3672	Unicorn-39236.exe
2892	Unicorn-26243.exe
4280	Unicorn-39258.exe
4796	Unicorn-43434.exe
552	Unicorn-29698.exe
1932	Unicorn-35942.exe
4236	Unicorn-59055.exe
3592	Unicorn-33804.exe
1064	Unicorn-39926.exe
4384	Unicorn-13191.exe
3240	Unicorn-28136.exe
436	Unicorn-23498.exe
4944	Unicorn-31401.exe
644	Unicorn-29528.exe
3904	Unicorn-44586.exe
464	Unicorn-30850.exe
4000	Unicorn-40794.exe
700	Unicorn-29096.exe
5052	Unicorn-20374.exe
2252	Unicorn-59268.exe
4684	Unicorn-63252.exe
2756	Unicorn-22874.exe
5068	Unicorn-12013.exe
3332	Unicorn-42740.exe
884	Unicorn-3083.exe
3112	Unicorn-42740.exe
4780	Unicorn-33180.exe
1288	Unicorn-53046.exe
3144	Unicorn-62391.exe
4952	Unicorn-56865.exe
4088	Unicorn-24357.exe
2056	Unicorn-45226.exe
2240	Unicorn-59424.exe
3860	Unicorn-47727.exe
4956	Unicorn-31390.exe
1628	Unicorn-57286.exe
2492	Unicorn-65454.exe
5108	Unicorn-55651.exe
3488	Unicorn-23143.exe
2508	Unicorn-2723.exe
5032	Unicorn-61754.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
7772	644	WerFault.exe	125
9972	644	WerFault.exe	125
12144	11876	WerFault.exe	538
14004	7704	WerFault.exe	310

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36484.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1040	dwm.exe
Token: SeChangeNotifyPrivilege	1040	dwm.exe
Token: 33	1040	dwm.exe
Token: SeIncBasePriorityPrivilege	1040	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe
1760	Unicorn-16910.exe
2456	Unicorn-46650.exe
5080	Unicorn-34952.exe
1564	Unicorn-46492.exe
2484	Unicorn-40270.exe
3872	Unicorn-26626.exe
4472	Unicorn-48530.exe
5112	Unicorn-16726.exe
4748	Unicorn-24793.exe
2764	Unicorn-30924.exe
4392	Unicorn-11058.exe
2412	Unicorn-20810.exe
4688	Unicorn-30924.exe
3840	Unicorn-4016.exe
1532	Unicorn-49953.exe
4740	Unicorn-15740.exe
468	Unicorn-53819.exe
796	Unicorn-6009.exe
3352	Unicorn-14269.exe
4336	Unicorn-57156.exe
4984	Unicorn-55018.exe
2892	Unicorn-26243.exe
2752	Unicorn-55018.exe
3160	Unicorn-5552.exe
3672	Unicorn-39236.exe
4280	Unicorn-39258.exe
552	Unicorn-29698.exe
4796	Unicorn-43434.exe
1932	Unicorn-35942.exe
4236	Unicorn-59055.exe
3592	Unicorn-33804.exe
1064	Unicorn-39926.exe
3240	Unicorn-28136.exe
4384	Unicorn-13191.exe
436	Unicorn-23498.exe
4944	Unicorn-31401.exe
644	Unicorn-29528.exe
464	Unicorn-30850.exe
3904	Unicorn-44586.exe
700	Unicorn-29096.exe
4000	Unicorn-40794.exe
5052	Unicorn-20374.exe
5068	Unicorn-12013.exe
884	Unicorn-3083.exe
3332	Unicorn-42740.exe
3112	Unicorn-42740.exe
2252	Unicorn-59268.exe
2756	Unicorn-22874.exe
4780	Unicorn-33180.exe
4684	Unicorn-63252.exe
1288	Unicorn-53046.exe
4952	Unicorn-56865.exe
4088	Unicorn-24357.exe
3144	Unicorn-62391.exe
2056	Unicorn-45226.exe
2240	Unicorn-59424.exe
3860	Unicorn-47727.exe
4956	Unicorn-31390.exe
5108	Unicorn-55651.exe
1628	Unicorn-57286.exe
2492	Unicorn-65454.exe
3488	Unicorn-23143.exe
2508	Unicorn-2723.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 1760	5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe	86
PID 5092 wrote to memory of 1760	5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe	86
PID 5092 wrote to memory of 1760	5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe	86
PID 1760 wrote to memory of 2456	1760	Unicorn-16910.exe	88
PID 1760 wrote to memory of 2456	1760	Unicorn-16910.exe	88
PID 1760 wrote to memory of 2456	1760	Unicorn-16910.exe	88
PID 5092 wrote to memory of 5080	5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe	89
PID 5092 wrote to memory of 5080	5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe	89
PID 5092 wrote to memory of 5080	5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe	89
PID 2456 wrote to memory of 2484	2456	Unicorn-46650.exe	92
PID 2456 wrote to memory of 2484	2456	Unicorn-46650.exe	92
PID 2456 wrote to memory of 2484	2456	Unicorn-46650.exe	92
PID 1760 wrote to memory of 3872	1760	Unicorn-16910.exe	93
PID 1760 wrote to memory of 3872	1760	Unicorn-16910.exe	93
PID 1760 wrote to memory of 3872	1760	Unicorn-16910.exe	93
PID 5080 wrote to memory of 1564	5080	Unicorn-34952.exe	94
PID 5080 wrote to memory of 1564	5080	Unicorn-34952.exe	94
PID 5080 wrote to memory of 1564	5080	Unicorn-34952.exe	94
PID 5092 wrote to memory of 4472	5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe	95
PID 5092 wrote to memory of 4472	5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe	95
PID 5092 wrote to memory of 4472	5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe	95
PID 3872 wrote to memory of 5112	3872	Unicorn-26626.exe	96
PID 3872 wrote to memory of 5112	3872	Unicorn-26626.exe	96
PID 3872 wrote to memory of 5112	3872	Unicorn-26626.exe	96
PID 2484 wrote to memory of 2412	2484	Unicorn-40270.exe	97
PID 2484 wrote to memory of 2412	2484	Unicorn-40270.exe	97
PID 2484 wrote to memory of 2412	2484	Unicorn-40270.exe	97
PID 1760 wrote to memory of 4748	1760	Unicorn-16910.exe	98
PID 1760 wrote to memory of 4748	1760	Unicorn-16910.exe	98
PID 1760 wrote to memory of 4748	1760	Unicorn-16910.exe	98
PID 1564 wrote to memory of 4688	1564	Unicorn-46492.exe	99
PID 1564 wrote to memory of 4688	1564	Unicorn-46492.exe	99
PID 1564 wrote to memory of 4688	1564	Unicorn-46492.exe	99
PID 4472 wrote to memory of 2764	4472	Unicorn-48530.exe	101
PID 4472 wrote to memory of 2764	4472	Unicorn-48530.exe	101
PID 4472 wrote to memory of 2764	4472	Unicorn-48530.exe	101
PID 2456 wrote to memory of 4392	2456	Unicorn-46650.exe	100
PID 2456 wrote to memory of 4392	2456	Unicorn-46650.exe	100
PID 2456 wrote to memory of 4392	2456	Unicorn-46650.exe	100
PID 5080 wrote to memory of 1532	5080	Unicorn-34952.exe	102
PID 5080 wrote to memory of 1532	5080	Unicorn-34952.exe	102
PID 5080 wrote to memory of 1532	5080	Unicorn-34952.exe	102
PID 5092 wrote to memory of 3840	5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe	103
PID 5092 wrote to memory of 3840	5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe	103
PID 5092 wrote to memory of 3840	5092	4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe	103
PID 5112 wrote to memory of 4740	5112	Unicorn-16726.exe	104
PID 5112 wrote to memory of 4740	5112	Unicorn-16726.exe	104
PID 5112 wrote to memory of 4740	5112	Unicorn-16726.exe	104
PID 3872 wrote to memory of 468	3872	Unicorn-26626.exe	105
PID 3872 wrote to memory of 468	3872	Unicorn-26626.exe	105
PID 3872 wrote to memory of 468	3872	Unicorn-26626.exe	105
PID 4392 wrote to memory of 796	4392	Unicorn-11058.exe	106
PID 4392 wrote to memory of 796	4392	Unicorn-11058.exe	106
PID 4392 wrote to memory of 796	4392	Unicorn-11058.exe	106
PID 2456 wrote to memory of 3352	2456	Unicorn-46650.exe	107
PID 2456 wrote to memory of 3352	2456	Unicorn-46650.exe	107
PID 2456 wrote to memory of 3352	2456	Unicorn-46650.exe	107
PID 4748 wrote to memory of 4336	4748	Unicorn-24793.exe	108
PID 4748 wrote to memory of 4336	4748	Unicorn-24793.exe	108
PID 4748 wrote to memory of 4336	4748	Unicorn-24793.exe	108
PID 1760 wrote to memory of 3160	1760	Unicorn-16910.exe	109
PID 1760 wrote to memory of 3160	1760	Unicorn-16910.exe	109
PID 1760 wrote to memory of 3160	1760	Unicorn-16910.exe	109
PID 3840 wrote to memory of 4984	3840	Unicorn-4016.exe	110

C:\Users\Admin\AppData\Local\Temp\4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe
"C:\Users\Admin\AppData\Local\Temp\4be63482950d19733d7ca8cb1d1bb62609cb093f66a36dca731c136008842b19.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46650.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59398.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57618.exe
        8⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52626.exe
        9⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe
        9⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        9⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14312.exe
        8⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
        8⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2844.exe
        8⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        8⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        8⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45002.exe
        8⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2365.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13570.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5445.exe
        7⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20430.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
        8⤵
        
        PID:17720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        7⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        6⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        6⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34797.exe
        6⤵
        
        PID:17176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9429.exe
        7⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23794.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        9⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64385.exe
        9⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27131.exe
        9⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5681.exe
        8⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
        8⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23502.exe
        8⤵
        
        PID:17128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24924.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        8⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16684.exe
        9⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        8⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22663.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        7⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        7⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50614.exe
        7⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47560.exe
        7⤵
        
        PID:18324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
        6⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28942.exe
        8⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
        8⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31789.exe
        8⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
        7⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
        7⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
        6⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10944.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        6⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        6⤵
        
        PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47328.exe
        8⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63949.exe
        8⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11535.exe
        8⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        7⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        7⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        6⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29150.exe
        7⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64140.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38433.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        6⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7986.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52351.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        6⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
        6⤵
        
        PID:16792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13886.exe
        5⤵
        
        PID:11224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
        5⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2701.exe
        5⤵
        
        PID:16504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13191.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        7⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
        8⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        9⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        10⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
        10⤵
        
        PID:17836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        9⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        9⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        9⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        8⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        8⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20577.exe
        8⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe
        8⤵
        
        PID:17144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        8⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11702.exe
        8⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        8⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        8⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
        7⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        7⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe
        7⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21468.exe
        6⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18942.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exe
        8⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        8⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe
        8⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
        8⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55745.exe
        8⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50134.exe
        7⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        7⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
        7⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        7⤵
        
        PID:16180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57649.exe
        6⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        6⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52654.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28136.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3015.exe
        6⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29243.exe
        8⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14983.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43694.exe
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5401.exe
        7⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        7⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        7⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35038.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20966.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        8⤵
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        7⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45744.exe
        7⤵
        
        PID:16368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        7⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        6⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        7⤵
        
        PID:18284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41007.exe
        6⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58147.exe
        6⤵
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
        5⤵
        
        PID:704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe
        7⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36742.exe
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        7⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe
        7⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
        7⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
        6⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26013.exe
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45195.exe
        6⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        6⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
        5⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exe
        6⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26026.exe
        7⤵
        
        PID:16740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        6⤵
        
        PID:12404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe
        6⤵
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe
        5⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53139.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51144.exe
        5⤵
        
        PID:15284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14507.exe
        5⤵
        
        PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23498.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53586.exe
        6⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30504.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29085.exe
        8⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        8⤵
        
        PID:16596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59071.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        8⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20202.exe
        7⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        7⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11660.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe
        7⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49636.exe
        7⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        7⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41007.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6232.exe
        6⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58993.exe
        5⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52932.exe
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25984.exe
        8⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        8⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9652.exe
        7⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20577.exe
        6⤵
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43756.exe
        6⤵
        
        PID:16048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17663.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
        6⤵
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
        5⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29658.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        6⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3451.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13622.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
        7⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38433.exe
        6⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25167.exe
        5⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29102.exe
        6⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
        5⤵
        
        PID:11108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        5⤵
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        5⤵
        
        PID:16676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
      4⤵
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        5⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38686.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1042.exe
      4⤵
      PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16306.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        5⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe
        5⤵
        
        PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41922.exe
      4⤵
      PID:8948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
      4⤵
      PID:12580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61969.exe
      4⤵
      PID:2332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        8⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        9⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43524.exe
        10⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        11⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        10⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        10⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25796.exe
        9⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3919.exe
        9⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
        9⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9853.exe
        8⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
        9⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22750.exe
        9⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exe
        9⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
        8⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
        8⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4914.exe
        7⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        8⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        8⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7888.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        7⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22108.exe
        8⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
        8⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35579.exe
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        7⤵
        
        PID:16568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4167.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
        8⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26778.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21109.exe
        9⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        9⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17986.exe
        8⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45221.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        7⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
        8⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        7⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        7⤵
        
        PID:16180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48224.exe
        7⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14565.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30504.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        7⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55782.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
        6⤵
        
        PID:17552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        8⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe
        9⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe
        9⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62351.exe
        8⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe
        7⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55584.exe
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        8⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        8⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe
        7⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-550.exe
        7⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28989.exe
        7⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        6⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        7⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe
        7⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9128.exe
        6⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11876 -s 216
        7⤵
        Program crash
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35823.exe
        6⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47560.exe
        6⤵
        
        PID:18316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22402.exe
        6⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14722.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        7⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe
        6⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53270.exe
        7⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe
        6⤵
        
        PID:11472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
        6⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12917.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        6⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        6⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1722.exe
        5⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
        5⤵
        
        PID:11780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exe
        5⤵
        
        PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53819.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62958.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
        9⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        9⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7224.exe
        9⤵
        
        PID:18336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        8⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe
        8⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        8⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20238.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
        8⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10830.exe
        7⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        7⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
        8⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55745.exe
        8⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19486.exe
        7⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
        7⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        6⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
        7⤵
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62605.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        6⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        6⤵
        
        PID:16516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38978.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        8⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51251.exe
        7⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
        6⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        6⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
        6⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
        6⤵
        
        PID:16888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60258.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        6⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45744.exe
        6⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe
        5⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        6⤵
        
        PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2025.exe
        5⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42744.exe
        5⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        5⤵
        
        PID:16556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        7⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9844.exe
        7⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
        7⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        6⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5309.exe
        7⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35900.exe
        7⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
        7⤵
        
        PID:16620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31275.exe
        6⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        6⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        6⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe
        5⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        6⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16550.exe
        7⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        7⤵
        
        PID:16484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        6⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
        5⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50516.exe
        5⤵
        
        PID:112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
      4⤵
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        6⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28318.exe
        5⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe
        5⤵
        
        PID:12732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        5⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64096.exe
        5⤵
        
        PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56595.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52626.exe
        5⤵
        
        PID:10912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        5⤵
        
        PID:14548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        5⤵
        
        PID:17204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64646.exe
      4⤵
      PID:10936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
      4⤵
      PID:14576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16634.exe
      4⤵
      PID:2404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57156.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29658.exe
        6⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        7⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe
        7⤵
        
        PID:7104
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 664
        6⤵
        Program crash
        
        PID:7772
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 664
        6⤵
        Program crash
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        5⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14167.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        7⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45744.exe
        7⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44261.exe
        7⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7322.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
        6⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe
        6⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8701.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48303.exe
        5⤵
        
        PID:9476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
        5⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47264.exe
        5⤵
        
        PID:12932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9740.exe
      4⤵
      PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17764.exe
        5⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        6⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9076.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
        6⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        5⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        5⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
      4⤵
      PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        5⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        5⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14110.exe
        5⤵
        
        PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
      4⤵
      PID:9320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
      4⤵
      PID:8592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18077.exe
      4⤵
      PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28266.exe
      4⤵
      PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17810.exe
        6⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8692.exe
        5⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3263.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55501.exe
        5⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23125.exe
        5⤵
        
        PID:16668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe
      4⤵
      PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14167.exe
        5⤵
        
        PID:8164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
        5⤵
        
        PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50057.exe
      4⤵
      PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49254.exe
      4⤵
      PID:12604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
      4⤵
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65459.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33579.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        6⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        6⤵
        
        PID:17764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        5⤵
        
        PID:10784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        5⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
        5⤵
        
        PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60503.exe
      4⤵
      PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        5⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22108.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        6⤵
        
        PID:17584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        5⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        5⤵
        
        PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42054.exe
      4⤵
      PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
      4⤵
      PID:12720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50614.exe
      4⤵
      PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
      4⤵
      PID:17932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44238.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35252.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16664.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59507.exe
        5⤵
        
        PID:12860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57446.exe
        5⤵
        
        PID:11684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
      4⤵
      PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
      4⤵
      PID:13336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1858.exe
      4⤵
      PID:6760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
    3⤵
    PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
      4⤵
      PID:12648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
    3⤵
    PID:10444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41366.exe
    3⤵
    PID:14380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exe
    3⤵
    PID:17264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34952.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34952.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30924.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53586.exe
        6⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25548.exe
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19356.exe
        8⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        8⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16755.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        7⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        7⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36190.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        7⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        7⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        7⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        6⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56784.exe
        6⤵
        
        PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe
        5⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53808.exe
        7⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
        7⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47394.exe
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        6⤵
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6206.exe
        5⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21760.exe
        6⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17540.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        6⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        6⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54701.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        5⤵
        
        PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        5⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        6⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47551.exe
        7⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38048.exe
        6⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
        6⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33770.exe
        6⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1380.exe
        5⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34562.exe
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40648.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe
        6⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50562.exe
        5⤵
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
      4⤵
      PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46352.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
        6⤵
        
        PID:216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5681.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50614.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49698.exe
        5⤵
        
        PID:17756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35859.exe
      4⤵
      PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12221.exe
        5⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        6⤵
        
        PID:16008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
        5⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        5⤵
        
        PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47222.exe
      4⤵
      PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
      4⤵
      PID:12700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29613.exe
      4⤵
      PID:16312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
      4⤵
      PID:18020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
        6⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55802.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        9⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
        9⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54551.exe
        8⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
        8⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        8⤵
        
        PID:16768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        7⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        7⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe
        6⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        7⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54680.exe
        7⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        7⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
        6⤵
        
        PID:13092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64385.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        6⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56662.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        5⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        5⤵
        
        PID:14632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
        5⤵
        
        PID:17224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20120.exe
        5⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
        6⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16384.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48894.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9844.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        6⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38266.exe
        5⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19290.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12024.exe
        6⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
        5⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        5⤵
        
        PID:16700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2121.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21822.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        6⤵
        
        PID:18012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6387.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50301.exe
        5⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        5⤵
        
        PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14504.exe
      4⤵
      PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62902.exe
      4⤵
      PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33268.exe
      4⤵
      PID:14656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe
      4⤵
      PID:7628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        5⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39336.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24858.exe
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49892.exe
        8⤵
        
        PID:18276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        7⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40954.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe
        6⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
        6⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe
        5⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47328.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63949.exe
        6⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        6⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        5⤵
        
        PID:17048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe
      4⤵
      PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        5⤵
        
        PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
      4⤵
      PID:9048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
      4⤵
      PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17843.exe
      4⤵
      PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56865.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11432.exe
        5⤵
        
        PID:13524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28152.exe
      4⤵
      PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45666.exe
      4⤵
      PID:10920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
      4⤵
      PID:15272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
      4⤵
      PID:1248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
    3⤵
    PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
      4⤵
      PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        5⤵
        
        PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11126.exe
      4⤵
      PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe
      4⤵
      PID:14684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
      4⤵
      PID:16612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15337.exe
    3⤵
    PID:15200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
    3⤵
    PID:17160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30924.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47940.exe
        6⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4489.exe
        9⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16850.exe
        9⤵
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        8⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44271.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        7⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3451.exe
        7⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13622.exe
        7⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36258.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2365.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42351.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        6⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24374.exe
        5⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17764.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
        7⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
        7⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        7⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        6⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15168.exe
        6⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52626.exe
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        6⤵
        
        PID:14468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56268.exe
        6⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8230.exe
        5⤵
        
        PID:9300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64412.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
        6⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
        7⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46564.exe
        7⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        6⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1064.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48189.exe
        5⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50016.exe
        6⤵
        
        PID:12536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        6⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        6⤵
        
        PID:18260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-165.exe
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
        5⤵
        
        PID:14672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        5⤵
        
        PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        5⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        5⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        5⤵
        
        PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-882.exe
      4⤵
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
      4⤵
      PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
      4⤵
      PID:15700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
      4⤵
      PID:17032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39236.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        5⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16144.exe
        7⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe
        7⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
        6⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45221.exe
        6⤵
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        5⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        6⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44863.exe
        6⤵
        
        PID:17196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
        5⤵
        
        PID:10432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10830.exe
        5⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        5⤵
        
        PID:16748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3347.exe
        5⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19548.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43668.exe
        5⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
        5⤵
        
        PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
      4⤵
      PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50914.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
      4⤵
      PID:14716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29724.exe
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe
      4⤵
      PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
        5⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26586.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54463.exe
        6⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51354.exe
        6⤵
        
        PID:17712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        5⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62351.exe
        5⤵
        
        PID:15848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5848.exe
      4⤵
      PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28532.exe
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
        5⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
        5⤵
        
        PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32899.exe
      4⤵
      PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
      4⤵
      PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20795.exe
      4⤵
      PID:4744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
    3⤵
    PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
      4⤵
      PID:9960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
      4⤵
      PID:13084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42123.exe
      4⤵
      PID:3120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe
    3⤵
    PID:7136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45190.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
      4⤵
      PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19511.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
    3⤵
    PID:9308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5025.exe
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5441.exe
    3⤵
    PID:956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64037.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        6⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5323.exe
        5⤵
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe
        5⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28169.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        5⤵
        
        PID:16636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39262.exe
      4⤵
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32248.exe
        6⤵
        
        PID:16420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18370.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44436.exe
        5⤵
        
        PID:14496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        5⤵
        
        PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23633.exe
      4⤵
      PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61064.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55745.exe
        5⤵
        
        PID:17136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
      4⤵
      PID:10844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe
      4⤵
      PID:14840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe
      4⤵
      PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32642.exe
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        6⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        6⤵
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        5⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39034.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        5⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        5⤵
        
        PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6642.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
        5⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59227.exe
        5⤵
        
        PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
      4⤵
      PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        5⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55299.exe
        5⤵
        
        PID:18352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
      4⤵
      PID:12632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
      4⤵
      PID:11704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3299.exe
    3⤵
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54520.exe
      4⤵
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        5⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        5⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51635.exe
        5⤵
        
        PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46025.exe
      4⤵
      PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
      4⤵
      PID:15144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
      4⤵
      PID:16780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26243.exe
    3⤵
    PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe
      4⤵
      PID:8308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
      4⤵
      PID:11324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
      4⤵
      PID:16328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41392.exe
    3⤵
    PID:8672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32718.exe
    3⤵
    PID:12624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
    3⤵
    PID:1584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26243.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26243.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
      4⤵
      PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38376.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43550.exe
        6⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39108.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
        7⤵
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39714.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe
        6⤵
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        6⤵
        
        PID:16540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55563.exe
        5⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19215.exe
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        5⤵
        
        PID:15508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        5⤵
        
        PID:17012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34946.exe
        5⤵
        
        PID:9632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6222.exe
        5⤵
        
        PID:13372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39356.exe
        5⤵
        
        PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exe
      4⤵
      PID:9356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13570.exe
      4⤵
      PID:13316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
      4⤵
      PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49839.exe
    3⤵
    PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
      4⤵
      PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27950.exe
        5⤵
        
        PID:11656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9652.exe
      4⤵
      PID:400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
      4⤵
      PID:6404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-855.exe
    3⤵
    PID:7848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
    3⤵
    PID:11092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21407.exe
    3⤵
    PID:15132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
    3⤵
    PID:17216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
    3⤵
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18122.exe
      4⤵
      PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38754.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
      4⤵
      PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18012.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
      4⤵
      PID:16728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62963.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 488
      4⤵
      Program crash
      PID:14004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30699.exe
    3⤵
    PID:10756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
    3⤵
    PID:8052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21822.exe
    3⤵
    PID:212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe
      4⤵
      PID:9656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
      4⤵
      PID:12988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
      4⤵
      PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
    3⤵
    PID:8524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
    3⤵
    PID:14344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
    3⤵
    PID:16876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
  2⤵
  PID:7584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
    3⤵
    PID:16996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
  2⤵
  PID:10368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
  2⤵
  PID:14740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
  2⤵
  PID:16828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 644 -ip 644
1⤵
PID:7404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 644 -ip 644
1⤵
PID:9464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 11876 -ip 11876
1⤵
PID:12016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7704 -ip 7704
1⤵
PID:12696

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11058.exe

Filesize
468KB

MD5
fb5b67ff74da740bb7a8e7264df8e9c6

SHA1
2bda6b0f0749ac6e6ce2613550d3e1ed082b97f4

SHA256
cd6fc3cadd28730709af49c66360b9db66f81f0df55e4311dc9b764f7dad2ff0

SHA512
1063b3ab0a33b96594bb47b9d8b68dac6aa8eec6a8affca277dbf840ab785369fd8c06ec5d47f3efa9947819146ebc41f7a316b4163611993d19af7100e885ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe

Filesize
468KB

MD5
4f30e8525039ae6e77c0fc2f344eeb8b

SHA1
088fb5911fe2b3d30c785e88161922399a7fafc3

SHA256
76fc02c0f347ee39765f0534443c3c930d8e1e665d7697819608a55b68889fc0

SHA512
718447d87df55bb007f4ea5a9def1d27bf04d3904aa700b84b70e41c2805623725f94db412b3dc24fce842e6398a35b6503a0ca519b3d54951b166ec827a6032

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe

Filesize
468KB

MD5
9a49c92e65919c83197be7dcb611ec51

SHA1
9efc6a894880c9f3737a970adb9b5ac40c0785ec

SHA256
bb71c37feeada18b364433f4f9ce934b30434260a347c27c50ad9b1b635c4ef7

SHA512
6ec77db5e90c23f4e5edb394cf4c36f41e5230b836b7c557381ae10203c419850248882f5064d680db4d2ed616bb50bd32385491ce0781c51bbc8940681e4a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe

Filesize
468KB

MD5
d56c249522e825e7d014e574840ece76

SHA1
6efbb5cb66776c49104c5c4591d7b88ef147ede4

SHA256
b2cb55676b3deddf25f6f0973b6d73c7cdaf5fdc284a6d7bbfc2ca4fe5194c7a

SHA512
7c8c464dabafbf7787565eb24c10469e8ea1df738a2206718f00c1ff934b01913e4dd6ab1f1069fb5561e50493cc22f41dbc7cc2bd1cbee08f8806af4bfefdf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe

Filesize
468KB

MD5
50f1255eb2b01aeb1bf8b674eab4cc2f

SHA1
d5241b3bc77d4085ef28c95218e8bfa8579ce7cc

SHA256
8da84c493e5ff937ef5a1fd2755a7c89bb6c0a3e9e3874ed8dc7dc78ff0ecf4b

SHA512
48c085474a7a510f96be3ea3a05afb23350736f935f0536ffe047cb8d1c70a989c191ecaa571dabf73916c84c20d8c6f97a5599522862434fdffed91e1190eef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe

Filesize
468KB

MD5
c4b1482605a983c1549281193541a03c

SHA1
e1d0ac4e4ef4dfd498f3d352e6cf695a305598f8

SHA256
5a7d674685deb459c8ac52d6949afad0f76aa14963bcba12215a3aa33d5504aa

SHA512
1fd2f946b67b4b8d47244e46f4f5b8bf1da4ac1a4b6c8b4d32341b6edd3aa471c6534e8f8179bab67014f98e912fbd6ad0f7b1bc3ea274fd0951bd08aa7c293e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe

Filesize
468KB

MD5
cad9200219726829c1fa873bee031bfb

SHA1
ce6683bddcc16702f6e600df33628863c916a330

SHA256
0ec9facf33652a3990bc6d9675addfe137b43b5db41249193520319182699d41

SHA512
43a9f984956377d413c8ba190377d5cc79fc4200a8d439a91f03b6e6e8963888136b5ced867a19a9233e49cbb6c2623336c0ecb89c55484ccd91188813cccb97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26243.exe

Filesize
468KB

MD5
b09d0c7ea14f7cac33b9f0aa0f8b6b2c

SHA1
7afc68c5dc89bac35e997236862444381d4312f2

SHA256
c69eb22dc4c5322cad2d75cb4474fb4140bd682bf31616aa1c359e59bb0de529

SHA512
6d341d22b44266341e4b7d50f9917992d5da6904e60b27a5d8ad706e8e9c18503383970d976ddadc67c5ad64a81996a984e06d33c9fa5277a3caee5fe6872b2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe

Filesize
468KB

MD5
08275b30c8199b656354ea99a7861b74

SHA1
f672512665d2aec68aa57228143fa19be78e467f

SHA256
c14b0953d27939f30c25915af46cce9ef73d5e90e45c1d829035a4a47cf8d07a

SHA512
956be317b8ce17c4a05410dc40a7fa9b9941a545c0b4aa513928692efe84a51d915949a10cce557fe032585a6f7d68d6595b58da56456dd821f5e7568ef646c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe

Filesize
468KB

MD5
7b5bb25188d485039a799e06343ecd9c

SHA1
aca8a582173577d5584e776923bad8733cfe94ed

SHA256
0472510bb2c84c6c65038fa61b639ebd82798e8aa95ba01c32996df14868d834

SHA512
e250fdc5767c2e535178ac029a6efa5cfeaee93edbaf957248fa415c53ab765361c139e371431bbe3119eef1a404cf548db80b9ae6fea8017c5a2aaa3583dc31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30924.exe

Filesize
468KB

MD5
b0fce12a331c1d6a0737d7b6d0a7e831

SHA1
145d2d11253411f3d24eaac620302a5ba1f866ce

SHA256
bd1b235a712534c4ecfc7e42ae7dfa5c06a196acb1ae275592724c94abd7d259

SHA512
b5290f0670e49fc4908c3f5f8b8c4e624a5e9c48c5722fa3980fe057eea2d80dd07fb043cc63ce505262615d2997a7330c8b2db8b71830a9390e27725fe38b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe

Filesize
468KB

MD5
5cd52c917f6136ced17f3f9b99d67b8d

SHA1
6245b02978185ad2f99ccfbebe2d729b23df7596

SHA256
c6e115d9c883703220be436c676a66a05e0ab66dae02cb9cf78ab6aff5c2aa9a

SHA512
40b53f9e5ded0553d2d345bed133b55e405bba80ca32fbc22bf115562e8fff4c6e0d85ce9f3b868f8f1fac21f1498ae609cc4ef7e485ad2288c22bfec4c7de71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34952.exe

Filesize
468KB

MD5
5e5486093cbb80f1f85fd2a8b5872b16

SHA1
a2b95b80f202f7a7ff689abc73de6d82e22e620b

SHA256
d94f49ca1d3e73231d5891642433bda26285fef2f3c16d3806fb514bfb4ea831

SHA512
e2b7bb54f703fab2d46c095e87fb935395ee2b18e03141942ab3b62bd14bf4ea739d126c66168627b56a2282b71f5e2ba0d6ae682015a3fc6ad06ecd1b4c0a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe

Filesize
468KB

MD5
8c85b20918dce0fe3f5a58be260af8ae

SHA1
b2d987972288abaeec7d419188928c47fff23f48

SHA256
adffd53f93924cb1d838a21ddbb63d67f3f78370b4f55017c865f085a98358e1

SHA512
a7a0c27715db1c20dda14e58d205596f889404dc5d446ebe9494133c7eb216c6c39c56f075cf59f25986b5a9ca4b7e3ab8e0146c08c6eb8bd8aa0f5b04bef9c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39236.exe

Filesize
468KB

MD5
9b0fa0e81fd0fd1a8acf159534686459

SHA1
311eeab5257e8f65bbe9200452f40432b1126fba

SHA256
bb21b3549864f1e1dc9110d774ca0794018c3bc359e939214a4fc3a565fa620d

SHA512
41674afecc63acae143ce8ff0d0bae7d75003f3e7d6801c94eb0716b68f80b5fdcd001b3ccbbaee9b8b54e1728498c14eabc4c6b11ddd2c74ae52ae914cbba75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe

Filesize
468KB

MD5
08a5d9d0a9597c8539197b09605211e8

SHA1
e5eeb90114ca45c3577d67b95c0cb5a30708500f

SHA256
647e61f977677677b2398195f7a1f7c0a79bf1a150eb995e45bf272f38cd4fa8

SHA512
f73e373d21150e797dcbea7f16baa88476e5e66937ba0ccbbdb7ca6080510964eee7c11f49a044122e39b25fce7bc74601717d2bf83fabdf2ee298cd1c31945f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe

Filesize
468KB

MD5
9a680fe41517b6dbdbfc3b560c593e9b

SHA1
6b440ff40c65ae2c29673521745b0db44e8ba2e6

SHA256
35b2e3f42d1e7a7f8c4c1e5e4d5bdd720c87dcbde6a0b7388b67e28f56d75a4e

SHA512
8e5c5b01644258fd5ca58fe52e5a689c18d08c9c55c5b332c614c156f740addd84319fb9c3ce6878fb154e4201ffa903b5f400ec477f766c82b61290b9932db3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe

Filesize
468KB

MD5
1a797e8b7f96e3b60765ed55696d853e

SHA1
e36020d860225a2e980939892ace659cf74a24e9

SHA256
bb7afd75addd8319cc5fdc1774bef071033253a28bac3b4eba1dcaf96003a3f0

SHA512
f53b0bb3236093129f2d877c2ce08e45b06c61937948cba86babe787e23fbc08eaa2b6f25e61863d82693409ece171290d5981f668fad69b2635c53ebebe2dd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe

Filesize
468KB

MD5
78ce7b97c74fcc46a0c45d9f6133a7b2

SHA1
b507779338cecab461e0c3bf686821ce3dc6fc22

SHA256
60762f67d67851a029e0ea24b7bac207c651d4791c220397e2a418fbe2f686f3

SHA512
e6f1576551a2294d5eccad568492e0717b4563c7eb4d7508d0cdc75dc5301a3b7e33fa267f25adfbfbf54fc3cfc8f29d6617c18141fec4e79545d161912959da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe

Filesize
468KB

MD5
fd701d339257c8508f571bc345dab2bd

SHA1
f728cf5a9d28a02feb8750f272c2081b2b074e23

SHA256
292e9915eb0518a5afa2df068aa3d70b524e8f49af1823048beb247c9ace4bcc

SHA512
75c615ed9a27f474938d48df61401d29c53ef6abd635d9fe597c561801115413645193a72a45332d466b06802d372d0c9523e857a8450d23c0cf2e2691d34600

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe

Filesize
468KB

MD5
909ebaad66c65071910a1ec56d185540

SHA1
764138b60d3036e1034768718863835054610a35

SHA256
176f8ca8936464b8d4b0f2b1a5a3c58e441721312d3d37b62453d5b4cdfb6976

SHA512
cd7e7e70b933a143472c7e4c77c936fbe8e3eb06e2906f8d172594a105238bb06aee11e637f019b48a68026bd19659610e339a015e6072f2a57c98464048faf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46650.exe

Filesize
468KB

MD5
c33274e17e26da5e833f60a992a70a32

SHA1
93cb38e0aea63786bba9c80fd60d776db62c56b0

SHA256
e9fe67ccfd9231474ff66f5e522055b1d59df52ef8b7d837808515b5ef336732

SHA512
28a2a4366b7ef1b4b10b68dab643f80be4aef5df11fa70ea7c22644982f95ae82cd25e8fa9c9a0be83b10700b3de8d29afe79545c3d985c96fc7b5c72b144eb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe

Filesize
468KB

MD5
1173755cd530c76a13a5dd6df582b6be

SHA1
13c05f866ada87ed331b3682a3d015f082e15561

SHA256
b5abaf96488140ad9ec9125b80932a44682460d915a9ff2c0dfe3ace7ea3f112

SHA512
87fd19ab380c5656c1165344d13f09e0d7b09941020cde713e431106ac183ca3a70cfa474580fabe940f9bc16d88bd133ba875aced48a449f994c6477d54546c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe

Filesize
468KB

MD5
7c172558903de3b2dbe683c219355fc2

SHA1
887e7e2c3a85352ef223eb31329963b87b71cc3c

SHA256
c37e7fe104787e5be037980f7f3ec6b76472de8853de818aac0c7aae0c43bc9a

SHA512
e456e5c6ff50b0a201ae446bde3ded619e368ca980909be6f8d630d5c52dd217dad843cf4fdd85a130d853658e23de3692c355270e627cde280742f983dbc64f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53819.exe

Filesize
468KB

MD5
05715e9a1e3d75aede69b81769e4c4cd

SHA1
9a59221f7baf610c6483a331e54ffaeb5a1db261

SHA256
5f558f240bb8ddc8c95276ded2a0c39add567f871c9e4609aca0a3c37c172847

SHA512
aa3899c4a4c1114414d88bfe30472e67133fde6a1f688713f8f2b21ff063bbffa402ad1fc178c6811214c5aadab445afc53cb7139333a892a2373ae83114f61b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe

Filesize
468KB

MD5
1c3f5300b0bcb28b80a98c894ded5ee0

SHA1
16997e68918094084d3304ec0bb20a479fc7f80a

SHA256
cea2950081aa98adaf909fc96e20625e38417d49b2cc9f8eb91498e3fab24564

SHA512
590fcc9787f96b6d6783a7460480d88055c291dd00d34a5bb68ca8cb68c3ab1e38a518af2a3106a5a14c575898a2d7c7f600578b0806454c9bb0d7a75c6ce67b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe

Filesize
468KB

MD5
9f3be22294d99d7a217534d853013e88

SHA1
b05683dd64328b650f4e8d5682a2f4e83659fc73

SHA256
8aa8f7a272d3e467b4f04ff21ca9c9fa0b0f55d6edafd97f5a30225ee4af29b8

SHA512
3e0051f10aea917eee11b7cb98ba6371fa5f326d44fca6bd3a1219cc293fd81da72ebaa0f6336000e3e1f26f79a337a60b57437d0298673293ee98e228f3c11b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57156.exe

Filesize
468KB

MD5
28390399197d825578b99608cb60687d

SHA1
111264ae60234cf3e38096e0e4ec785735c73d9b

SHA256
3ba1290ef6565c97264249ebd35fb01a3b9c2a2a420a45dd0e859a638a6482c4

SHA512
69788ac9fd81280586785a5ba92065e20de2f7d5f12bb84dabb990f781d79abc08526b611a1809dda9e5bfaa7f4a35604907ccc45d66ae0d798c4187b35eccd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe

Filesize
468KB

MD5
5d95d8e887f60f291595068477a03ba5

SHA1
ed70916ca17310ca066b7df9650e8aa6dd607f39

SHA256
784d9c5d03d252564ed1cabf03228df9c6e70a18dd01df84b0b1440094db8de9

SHA512
6261a9080640e9bc9e9c43542732271e55281f0e263a4a8d068c2be06bd51a833ef84962a72d355272dfce8173ff667868cf12d0072c15cbec1efcf14683e76c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe

Filesize
468KB

MD5
e5169c9ed5001d115d4ac0e6efcd2ed5

SHA1
0f266d170f02e8cbc929b9b4b407e67d6fa88ad8

SHA256
40b47f2158b2d65f847d290c842aa389a3a00296feece51bc657808357d33475

SHA512
791e03f77935057a86e78a67e5d43f7c3b3859e015e997498b6b97527821dec9983839b31d01d191665097052e4e9d67a18b6a0a090bc51a915a234da426bebf

Download Submit
memory/436-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/464-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/468-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/552-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/700-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/704-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/796-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/884-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1064-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1236-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1288-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1320-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1412-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2252-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2832-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3144-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3156-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3160-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3172-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3240-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3332-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3592-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3640-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3672-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3840-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3860-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3872-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3904-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3924-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4000-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4088-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4292-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4336-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4384-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4392-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4412-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4472-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4684-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4688-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4704-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4748-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4780-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4812-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4952-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4956-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5068-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5160-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-570-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-571-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5440-572-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-573-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-574-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5492-575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15408-2661-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads