b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe
Size

468KB
MD5

928227e3e3b2d19ca83be5034dd5d600
SHA1

63ba563f54906620a8c074385f1c951c9dc12f3c
SHA256

b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746
SHA512

25a4a57ad5b7936dcfa786c5a8b6c05b7bf70e998489472b3d7a90000c08103996ee27bf4a2e59c1af6864c3aeb450ff373afa2e9c438bcbcc1754e1e00c6269
SSDEEP

3072:m3mCogWxjQ8pmbxDPz/Czf8/brh3aDpoymHBaVrr9ZZ3WH+FDbm4:m3roBdpmRPbCzfFdgK9Zh4+FD

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4508	Unicorn-28372.exe
3384	Unicorn-12235.exe
4584	Unicorn-41570.exe
4140	Unicorn-23580.exe
3148	Unicorn-52723.exe
4980	Unicorn-921.exe
3352	Unicorn-16490.exe
2096	Unicorn-28380.exe
4904	Unicorn-41186.exe
4832	Unicorn-35588.exe
1188	Unicorn-10626.exe
4404	Unicorn-4761.exe
4600	Unicorn-52988.exe
4004	Unicorn-14761.exe
4716	Unicorn-48883.exe
1668	Unicorn-3595.exe
1496	Unicorn-16402.exe
60	Unicorn-30020.exe
4948	Unicorn-62427.exe
2324	Unicorn-61623.exe
3776	Unicorn-40802.exe
4032	Unicorn-30596.exe
3280	Unicorn-46170.exe
1672	Unicorn-51571.exe
1708	Unicorn-61068.exe
4332	Unicorn-24866.exe
4468	Unicorn-44732.exe
4760	Unicorn-36683.exe
1064	Unicorn-45116.exe
2680	Unicorn-38986.exe
744	Unicorn-47036.exe
244	Unicorn-2474.exe
3136	Unicorn-63180.exe
3200	Unicorn-24953.exe
3844	Unicorn-40212.exe
2080	Unicorn-58586.exe
2904	Unicorn-48380.exe
2148	Unicorn-16284.exe
4016	Unicorn-56055.exe
5104	Unicorn-29090.exe
3080	Unicorn-31665.exe
2816	Unicorn-48691.exe
2116	Unicorn-45235.exe
456	Unicorn-40596.exe
2892	Unicorn-39634.exe
3612	Unicorn-38588.exe
4412	Unicorn-30228.exe
4620	Unicorn-30228.exe
2744	Unicorn-30804.exe
4900	Unicorn-30804.exe
3708	Unicorn-8337.exe
4792	Unicorn-55116.exe
1988	Unicorn-35250.exe
2924	Unicorn-55116.exe
4336	Unicorn-38780.exe
4148	Unicorn-46186.exe
3116	Unicorn-7954.exe
3676	Unicorn-16122.exe
3692	Unicorn-34761.exe
4532	Unicorn-20834.exe
2712	Unicorn-20834.exe
3536	Unicorn-53891.exe
816	Unicorn-53891.exe
1404	Unicorn-37362.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4536	1188	WerFault.exe	95
3268	1188	WerFault.exe	95
5588	3196	WerFault.exe	160
9504	6660	WerFault.exe	285
11872	6660	WerFault.exe	285
16236	14168	WerFault.exe	720

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62368.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16328	dwm.exe
Token: SeChangeNotifyPrivilege	16328	dwm.exe
Token: 33	16328	dwm.exe
Token: SeIncBasePriorityPrivilege	16328	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe
4508	Unicorn-28372.exe
3384	Unicorn-12235.exe
4584	Unicorn-41570.exe
3148	Unicorn-52723.exe
4140	Unicorn-23580.exe
4980	Unicorn-921.exe
3352	Unicorn-16490.exe
2096	Unicorn-28380.exe
4904	Unicorn-41186.exe
4404	Unicorn-4761.exe
1188	Unicorn-10626.exe
4832	Unicorn-35588.exe
4600	Unicorn-52988.exe
4004	Unicorn-14761.exe
4716	Unicorn-48883.exe
1668	Unicorn-3595.exe
1496	Unicorn-16402.exe
60	Unicorn-30020.exe
4032	Unicorn-30596.exe
4948	Unicorn-62427.exe
2324	Unicorn-61623.exe
3776	Unicorn-40802.exe
1672	Unicorn-51571.exe
3280	Unicorn-46170.exe
4332	Unicorn-24866.exe
4468	Unicorn-44732.exe
4760	Unicorn-36683.exe
2680	Unicorn-38986.exe
1064	Unicorn-45116.exe
744	Unicorn-47036.exe
3136	Unicorn-63180.exe
3200	Unicorn-24953.exe
244	Unicorn-2474.exe
3844	Unicorn-40212.exe
2080	Unicorn-58586.exe
2904	Unicorn-48380.exe
2148	Unicorn-16284.exe
5104	Unicorn-29090.exe
4016	Unicorn-56055.exe
2116	Unicorn-45235.exe
2816	Unicorn-48691.exe
3080	Unicorn-31665.exe
456	Unicorn-40596.exe
2892	Unicorn-39634.exe
3612	Unicorn-38588.exe
4412	Unicorn-30228.exe
4620	Unicorn-30228.exe
2744	Unicorn-30804.exe
3708	Unicorn-8337.exe
4900	Unicorn-30804.exe
4792	Unicorn-55116.exe
4336	Unicorn-38780.exe
2924	Unicorn-55116.exe
1988	Unicorn-35250.exe
3692	Unicorn-34761.exe
3676	Unicorn-16122.exe
3116	Unicorn-7954.exe
4148	Unicorn-46186.exe
3196	Unicorn-35146.exe
4532	Unicorn-20834.exe
2712	Unicorn-20834.exe
1404	Unicorn-37362.exe
816	Unicorn-53891.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 4508	3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe	83
PID 3944 wrote to memory of 4508	3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe	83
PID 3944 wrote to memory of 4508	3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe	83
PID 4508 wrote to memory of 3384	4508	Unicorn-28372.exe	84
PID 4508 wrote to memory of 3384	4508	Unicorn-28372.exe	84
PID 4508 wrote to memory of 3384	4508	Unicorn-28372.exe	84
PID 3944 wrote to memory of 4584	3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe	85
PID 3944 wrote to memory of 4584	3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe	85
PID 3944 wrote to memory of 4584	3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe	85
PID 4584 wrote to memory of 4140	4584	Unicorn-41570.exe	86
PID 4584 wrote to memory of 4140	4584	Unicorn-41570.exe	86
PID 4584 wrote to memory of 4140	4584	Unicorn-41570.exe	86
PID 4508 wrote to memory of 3148	4508	Unicorn-28372.exe	88
PID 4508 wrote to memory of 3148	4508	Unicorn-28372.exe	88
PID 4508 wrote to memory of 3148	4508	Unicorn-28372.exe	88
PID 3944 wrote to memory of 4980	3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe	87
PID 3944 wrote to memory of 4980	3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe	87
PID 3944 wrote to memory of 4980	3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe	87
PID 3384 wrote to memory of 3352	3384	Unicorn-12235.exe	91
PID 3384 wrote to memory of 3352	3384	Unicorn-12235.exe	91
PID 3384 wrote to memory of 3352	3384	Unicorn-12235.exe	91
PID 4140 wrote to memory of 2096	4140	Unicorn-23580.exe	92
PID 4140 wrote to memory of 2096	4140	Unicorn-23580.exe	92
PID 4140 wrote to memory of 2096	4140	Unicorn-23580.exe	92
PID 4584 wrote to memory of 4904	4584	Unicorn-41570.exe	93
PID 4584 wrote to memory of 4904	4584	Unicorn-41570.exe	93
PID 4584 wrote to memory of 4904	4584	Unicorn-41570.exe	93
PID 3148 wrote to memory of 4832	3148	Unicorn-52723.exe	94
PID 3148 wrote to memory of 4832	3148	Unicorn-52723.exe	94
PID 3148 wrote to memory of 4832	3148	Unicorn-52723.exe	94
PID 3944 wrote to memory of 1188	3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe	95
PID 3944 wrote to memory of 1188	3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe	95
PID 3944 wrote to memory of 1188	3944	b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe	95
PID 4508 wrote to memory of 4404	4508	Unicorn-28372.exe	96
PID 4508 wrote to memory of 4404	4508	Unicorn-28372.exe	96
PID 4508 wrote to memory of 4404	4508	Unicorn-28372.exe	96
PID 3352 wrote to memory of 4600	3352	Unicorn-16490.exe	99
PID 3352 wrote to memory of 4600	3352	Unicorn-16490.exe	99
PID 3352 wrote to memory of 4600	3352	Unicorn-16490.exe	99
PID 3384 wrote to memory of 4004	3384	Unicorn-12235.exe	100
PID 3384 wrote to memory of 4004	3384	Unicorn-12235.exe	100
PID 3384 wrote to memory of 4004	3384	Unicorn-12235.exe	100
PID 4980 wrote to memory of 4716	4980	Unicorn-921.exe	101
PID 4980 wrote to memory of 4716	4980	Unicorn-921.exe	101
PID 4980 wrote to memory of 4716	4980	Unicorn-921.exe	101
PID 2096 wrote to memory of 1668	2096	Unicorn-28380.exe	102
PID 2096 wrote to memory of 1668	2096	Unicorn-28380.exe	102
PID 2096 wrote to memory of 1668	2096	Unicorn-28380.exe	102
PID 4140 wrote to memory of 1496	4140	Unicorn-23580.exe	103
PID 4140 wrote to memory of 1496	4140	Unicorn-23580.exe	103
PID 4140 wrote to memory of 1496	4140	Unicorn-23580.exe	103
PID 4404 wrote to memory of 60	4404	Unicorn-4761.exe	104
PID 4404 wrote to memory of 60	4404	Unicorn-4761.exe	104
PID 4404 wrote to memory of 60	4404	Unicorn-4761.exe	104
PID 4508 wrote to memory of 4948	4508	Unicorn-28372.exe	107
PID 4508 wrote to memory of 4948	4508	Unicorn-28372.exe	107
PID 4508 wrote to memory of 4948	4508	Unicorn-28372.exe	107
PID 4904 wrote to memory of 2324	4904	Unicorn-41186.exe	106
PID 4904 wrote to memory of 2324	4904	Unicorn-41186.exe	106
PID 4904 wrote to memory of 2324	4904	Unicorn-41186.exe	106
PID 4584 wrote to memory of 3776	4584	Unicorn-41570.exe	108
PID 4584 wrote to memory of 3776	4584	Unicorn-41570.exe	108
PID 4584 wrote to memory of 3776	4584	Unicorn-41570.exe	108
PID 4832 wrote to memory of 4032	4832	Unicorn-35588.exe	110

C:\Users\Admin\AppData\Local\Temp\b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe
"C:\Users\Admin\AppData\Local\Temp\b52ac21c59b5749b5788b24699bed9c6e2c4738f5066efce51220bb6f8b6c746N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28372.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28372.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12235.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61068.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30228.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47436.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10347.exe
        9⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56209.exe
        10⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        10⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
        10⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4159.exe
        9⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        9⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        9⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
        9⤵
        
        PID:16692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46240.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe
        9⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        9⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31726.exe
        8⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4839.exe
        8⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
        8⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61276.exe
        8⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
        9⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe
        9⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exe
        8⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        8⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12367.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40927.exe
        8⤵
        
        PID:17412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30257.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        8⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46656.exe
        8⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53975.exe
        8⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
        8⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60952.exe
        7⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
        7⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28961.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35250.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36388.exe
        8⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43729.exe
        9⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8311.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        9⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41351.exe
        8⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        8⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        7⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        8⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        8⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
        8⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        8⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47199.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        7⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        7⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
        6⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
        8⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        8⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58527.exe
        8⤵
        
        PID:17316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1575.exe
        7⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exe
        7⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6831.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-495.exe
        6⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47023.exe
        6⤵
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4160.exe
        6⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24866.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        8⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7008.exe
        9⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        9⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
        9⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21222.exe
        9⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        8⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        8⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
        8⤵
        
        PID:18344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        7⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        8⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20599.exe
        8⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64055.exe
        8⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47864.exe
        8⤵
        
        PID:16648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31734.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37336.exe
        7⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
        7⤵
        
        PID:18376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6522.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        8⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        8⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        8⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11335.exe
        8⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
        7⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12182.exe
        7⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        6⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
        7⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        7⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        7⤵
        
        PID:17132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe
        6⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
        8⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        8⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47672.exe
        8⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25211.exe
        7⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
        7⤵
        
        PID:16732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26610.exe
        6⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
        7⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe
        7⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        6⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10347.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        7⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26520.exe
        7⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2377.exe
        5⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31855.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe
        6⤵
        
        PID:15544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exe
        6⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10095.exe
        5⤵
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19776.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46926.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14761.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        9⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        8⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30702.exe
        8⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe
        7⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        7⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
        7⤵
        
        PID:16956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31410.exe
        6⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27748.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27025.exe
        8⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        8⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe
        7⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        7⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62368.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26225.exe
        6⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15503.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6135.exe
        6⤵
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60612.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        7⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        7⤵
        
        PID:18316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
        6⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
        5⤵
        
        PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23589.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54047.exe
        5⤵
        
        PID:13604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63504.exe
        5⤵
        
        PID:16536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30228.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        7⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
        8⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
        8⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
        8⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        7⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42655.exe
        7⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25650.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43241.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48768.exe
        7⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        7⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20319.exe
        6⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe
        6⤵
        
        PID:15356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54571.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37540.exe
        6⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61512.exe
        7⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56551.exe
        6⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62088.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63610.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
        6⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        6⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        6⤵
        
        PID:16372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62488.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
        5⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6135.exe
        5⤵
        
        PID:16600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7008.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
        6⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14310.exe
        6⤵
        
        PID:17036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        5⤵
        
        PID:14388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
        5⤵
        
        PID:18336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10045.exe
      4⤵
      PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40553.exe
        5⤵
        
        PID:7984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6831.exe
        5⤵
        
        PID:16572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44929.exe
      4⤵
      PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
      4⤵
      PID:11960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4567.exe
      4⤵
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52723.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56209.exe
        8⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        8⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        8⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        8⤵
        
        PID:16480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4159.exe
        7⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        7⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        7⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22281.exe
        6⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35146.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 484
        6⤵
        Program crash
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        6⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        5⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49252.exe
        6⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        8⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
        8⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        8⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22607.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2639.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        6⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53905.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe
        7⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13023.exe
        6⤵
        
        PID:14064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53423.exe
        6⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29001.exe
        5⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        6⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        6⤵
        
        PID:16172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31022.exe
        5⤵
        
        PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38961.exe
        5⤵
        
        PID:16244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        7⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        7⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55264.exe
        7⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2670.exe
        6⤵
        
        PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
        5⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        6⤵
        
        PID:18176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        5⤵
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32799.exe
        5⤵
        
        PID:15208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
        5⤵
        
        PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
      4⤵
      PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
        6⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        7⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe
        7⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-719.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
        6⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57584.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
        5⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
        5⤵
        
        PID:64
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20825.exe
      4⤵
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35950.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46656.exe
        5⤵
        
        PID:12352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
        5⤵
        
        PID:16336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12184.exe
      4⤵
      PID:13172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26407.exe
      4⤵
      PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:60
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56844.exe
        6⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31705.exe
        8⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        8⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
        8⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20558.exe
        8⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4159.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        7⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        7⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46240.exe
        6⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        7⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        7⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48543.exe
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        6⤵
        
        PID:14168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14168 -s 468
        7⤵
        Program crash
        
        PID:16236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11950.exe
        6⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
        5⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        6⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        7⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55919.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
        6⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40401.exe
        7⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29607.exe
        7⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10702.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
        6⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe
        7⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44408.exe
        7⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62504.exe
        6⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        6⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45944.exe
        6⤵
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe
        5⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        5⤵
        
        PID:11928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6383.exe
        5⤵
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49241.exe
        5⤵
        
        PID:16864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29090.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        6⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        7⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        7⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45000.exe
        6⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe
        6⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        5⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23374.exe
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        5⤵
        
        PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
      4⤵
      PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43788.exe
        5⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61128.exe
        6⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18388.exe
        5⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56353.exe
        6⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9815.exe
        6⤵
        
        PID:17060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        5⤵
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20068.exe
        5⤵
        
        PID:15604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52847.exe
        5⤵
        
        PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        5⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        5⤵
        
        PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
      4⤵
      PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
      4⤵
      PID:14192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3880.exe
      4⤵
      PID:2052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62427.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        5⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27255.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        7⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38487.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29416.exe
        6⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
        5⤵
        
        PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51719.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
        5⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        5⤵
        
        PID:15104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
        5⤵
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
      4⤵
      PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        5⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        6⤵
        
        PID:14032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        6⤵
        
        PID:17272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4283.exe
        5⤵
        
        PID:11512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
        5⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
        5⤵
        
        PID:18328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37112.exe
      4⤵
      PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
      4⤵
      PID:16992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
      4⤵
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24022.exe
        6⤵
        
        PID:16260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        5⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
        5⤵
        
        PID:16908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11421.exe
      4⤵
      PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17723.exe
      4⤵
      PID:10604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
      4⤵
      PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-818.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
      4⤵
      PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33433.exe
        5⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-286.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        5⤵
        
        PID:14676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        5⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54959.exe
        5⤵
        
        PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
      4⤵
      PID:8372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1294.exe
      4⤵
      PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24568.exe
      4⤵
      PID:16020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe
      4⤵
      PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe
    3⤵
    PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
      4⤵
      PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
      4⤵
      PID:12536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
      4⤵
      PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22350.exe
    3⤵
    PID:9360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24151.exe
    3⤵
    PID:13304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
    3⤵
    PID:15308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61968.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28380.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        8⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        9⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        10⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        10⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
        10⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        10⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
        9⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        9⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53319.exe
        9⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
        8⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
        9⤵
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
        9⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
        8⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe
        8⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61584.exe
        8⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53419.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        8⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-704.exe
        9⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9415.exe
        9⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50096.exe
        8⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        8⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25156.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22697.exe
        8⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe
        8⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        8⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47216.exe
        7⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe
        7⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24775.exe
        7⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38929.exe
        9⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
        9⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        9⤵
        
        PID:18368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4071.exe
        8⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        8⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20199.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48855.exe
        7⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        7⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30151.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22281.exe
        6⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32385.exe
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        7⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31336.exe
        7⤵
        
        PID:17140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61616.exe
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        6⤵
        
        PID:15912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38780.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        8⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
        9⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
        9⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe
        9⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        8⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14007.exe
        8⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45192.exe
        7⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45825.exe
        8⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        7⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        7⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41119.exe
        7⤵
        
        PID:17432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41233.exe
        7⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        7⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29814.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13028.exe
        6⤵
        
        PID:13256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16702.exe
        6⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34761.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        6⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61188.exe
        7⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8192.exe
        8⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
        8⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29398.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42420.exe
        7⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55727.exe
        7⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59120.exe
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32712.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe
        6⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47359.exe
        6⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26419.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        6⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36136.exe
        6⤵
        
        PID:520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        5⤵
        
        PID:12332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55182.exe
        5⤵
        
        PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16402.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63180.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43191.exe
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        8⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
        8⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
        8⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45000.exe
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31584.exe
        7⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        7⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64023.exe
        7⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1892.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9598.exe
        7⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34183.exe
        6⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        6⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        8⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
        8⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49975.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
        7⤵
        
        PID:18360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        6⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63895.exe
        6⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        6⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        5⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
        5⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29751.exe
        5⤵
        
        PID:15236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        5⤵
        
        PID:17716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41572.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33730.exe
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        8⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61934.exe
        9⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe
        9⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
        8⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20319.exe
        7⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        7⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
        7⤵
        
        PID:17068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15453.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42681.exe
        7⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        7⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        7⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        6⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        5⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        6⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36487.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
        5⤵
        
        PID:11192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
        5⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        5⤵
        
        PID:16508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34172.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28023.exe
        6⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 632
        7⤵
        Program crash
        
        PID:9504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 632
        7⤵
        Program crash
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38487.exe
        6⤵
        
        PID:13632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        5⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        6⤵
        
        PID:16420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41351.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        5⤵
        
        PID:14080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
        5⤵
        
        PID:17352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
      4⤵
      PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40199.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14454.exe
        5⤵
        
        PID:13196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        5⤵
        
        PID:15144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52944.exe
      4⤵
      PID:9196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35537.exe
      4⤵
      PID:12188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55374.exe
      4⤵
      PID:368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41186.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40596.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42812.exe
        6⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60316.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        8⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4071.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        8⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
        8⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53064.exe
        7⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13784.exe
        8⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62472.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
        7⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
        7⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64291.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        7⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        7⤵
        
        PID:18352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48839.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44352.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        6⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22754.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11411.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        7⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        7⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51440.exe
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31470.exe
        6⤵
        
        PID:14268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64392.exe
        6⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9889.exe
        5⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        6⤵
        
        PID:12812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20654.exe
        6⤵
        
        PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23589.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54047.exe
        5⤵
        
        PID:13752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe
        5⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
        5⤵
        
        PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45235.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50980.exe
        5⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10347.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30127.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14587.exe
        7⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54968.exe
        7⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
        6⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        7⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26343.exe
        7⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30542.exe
        6⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26479.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
        6⤵
        
        PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        5⤵
        
        PID:8744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        5⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60136.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
      4⤵
      PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        5⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
        6⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51880.exe
        6⤵
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57759.exe
        6⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33463.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        5⤵
        
        PID:11432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        5⤵
        
        PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
        5⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
        5⤵
        
        PID:13672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe
      4⤵
      PID:9828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
      4⤵
      PID:13316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
      4⤵
      PID:15576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48380.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40124.exe
        5⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15705.exe
        8⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50656.exe
        8⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
        7⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe
        7⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21543.exe
        6⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        6⤵
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        6⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23303.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
        6⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
        5⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
        5⤵
        
        PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22946.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17172.exe
        5⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        6⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        7⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        7⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32375.exe
        6⤵
        
        PID:18228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45000.exe
        5⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23105.exe
        6⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37775.exe
        6⤵
        
        PID:16808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        5⤵
        
        PID:17100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3746.exe
      4⤵
      PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
      4⤵
      PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
      4⤵
      PID:12776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37617.exe
      4⤵
      PID:7916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48691.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50980.exe
      4⤵
      PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
        6⤵
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
        6⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        5⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe
        6⤵
        
        PID:16036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52695.exe
        5⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        5⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
        5⤵
        
        PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
      4⤵
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        5⤵
        
        PID:11424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        5⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1350.exe
        5⤵
        
        PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63831.exe
      4⤵
      PID:9820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
      4⤵
      PID:13324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
      4⤵
      PID:6728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33689.exe
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe
      4⤵
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32878.exe
        5⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62504.exe
        5⤵
        
        PID:440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        5⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53536.exe
        5⤵
        
        PID:17052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
      4⤵
      PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60391.exe
      4⤵
      PID:12372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33608.exe
      4⤵
      PID:15808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
    3⤵
    PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
      4⤵
      PID:5396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22941.exe
    3⤵
    PID:10008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
    3⤵
    PID:13652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
    3⤵
    PID:7212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-921.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-921.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60124.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42000.exe
        7⤵
        
        PID:15948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        6⤵
        
        PID:12568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21647.exe
        5⤵
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53849.exe
        5⤵
        
        PID:11460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
      4⤵
      Executes dropped EXE
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18132.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        6⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45944.exe
        6⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        5⤵
        
        PID:11800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46303.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
      4⤵
      PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
      4⤵
      PID:10596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61824.exe
      4⤵
      PID:12472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38986.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60124.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        6⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30542.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38559.exe
        5⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32041.exe
        6⤵
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        6⤵
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36551.exe
        5⤵
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31584.exe
        5⤵
        
        PID:15408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        5⤵
        
        PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30257.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
        5⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        5⤵
        
        PID:12300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
        5⤵
        
        PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60952.exe
      4⤵
      PID:8548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
      4⤵
      PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
      4⤵
      PID:16376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7954.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
      4⤵
      PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27255.exe
        5⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28073.exe
        6⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
        6⤵
        
        PID:13896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30702.exe
        5⤵
        
        PID:13180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61512.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19156.exe
      4⤵
      PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-704.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50464.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
      4⤵
      PID:10808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30040.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30262.exe
      4⤵
      PID:6256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
      4⤵
      PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
      4⤵
      PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
      4⤵
      PID:6788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39399.exe
    3⤵
    PID:6384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
    3⤵
    PID:11440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17678.exe
    3⤵
    PID:14792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28431.exe
    3⤵
    PID:6544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 720
    3⤵
    - Program crash
    PID:4536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 740
    3⤵
    - Program crash
    PID:3268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
      4⤵
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60124.exe
        5⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
        6⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
        6⤵
        
        PID:14704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        6⤵
        
        PID:17424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45000.exe
        5⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        5⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        5⤵
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        5⤵
        
        PID:16468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7005.exe
      4⤵
      PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24622.exe
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        5⤵
        
        PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
      4⤵
      PID:9676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3044.exe
      4⤵
      PID:12116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe
      4⤵
      PID:5096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
    3⤵
    PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43788.exe
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        5⤵
        
        PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
        5⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63815.exe
        5⤵
        
        PID:17340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20411.exe
      4⤵
      PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42904.exe
      4⤵
      PID:12684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51392.exe
      4⤵
      PID:1644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
    3⤵
    PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
      4⤵
      PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
      4⤵
      PID:16040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
    3⤵
    PID:9712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
    3⤵
    PID:12108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1423.exe
    3⤵
    PID:2216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42812.exe
    3⤵
    PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
        5⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19401.exe
        6⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        5⤵
        
        PID:11128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        5⤵
        
        PID:14572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22607.exe
      4⤵
      PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45487.exe
      4⤵
      PID:11480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
      4⤵
      PID:12736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
      4⤵
      PID:16636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
    3⤵
    PID:7136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
      4⤵
      PID:15608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26343.exe
      4⤵
      PID:16712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
    3⤵
    PID:10016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35686.exe
    3⤵
    PID:13676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
    3⤵
    PID:16424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
  2⤵
  PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
    3⤵
    PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49033.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6996.exe
      4⤵
      PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23550.exe
      4⤵
      PID:17328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25207.exe
    3⤵
    PID:9720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62716.exe
    3⤵
    PID:12204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
    3⤵
    PID:1908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1356.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1356.exe
  2⤵
  PID:7536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
    3⤵
    PID:11464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2310.exe
    3⤵
    PID:16820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
  2⤵
  PID:10204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
  2⤵
  PID:12504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30168.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30168.exe
  2⤵
  PID:16628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1188 -ip 1188
1⤵
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1188 -ip 1188
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3196 -ip 3196
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6660 -ip 6660
1⤵
PID:9688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6660 -ip 6660
1⤵
PID:11560

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10626.exe

Filesize
468KB

MD5
5eb31e43295ffa4e6ccbe387eee1012f

SHA1
159bde868787cae2c0a24b902a66fdb5ab7ae750

SHA256
398fe9b06566223f1a178e0d72a990d163bcb371cf39594815494f1cc0bda2a6

SHA512
9affcf518df942b7ec4cb98c950e76365b5fae56f62862a3b3576985ed7174be34be5d3883cdbe857197a7faceba040ad01146efbd0843980a74dd8abd04a749

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12235.exe

Filesize
468KB

MD5
adce0ba8196f54dfa2e3bdae39501b61

SHA1
8bb71bf46d51d8b41760e4b6412fda24fe6e3f54

SHA256
aeef4754b1be10eb7b381fe12972300112d28acd706f47e7bfd82316ccd6cb40

SHA512
b03b83c8493934039bde696fff91a450e330af990e510db814c4628e5fe10493100bcd22a3f1702139179a4f40aa0b02acd0c08565fe9c111218d2a0c3069edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14761.exe

Filesize
468KB

MD5
4e0a789decaa4e63b3d5ea73f5243db7

SHA1
5f888816200270eb938283ba8f72406e6bf27933

SHA256
c8000e73961cd27683746bf5ea22f0b4c43b3bddfdc4438c855a69239f1fbd7a

SHA512
a583d2f7c9d063b2a306fdf6a6b7588fc78a6c262798a2ffcd232cc0f1153c3bd3653d5ffb0c1c078a8ec262df9dfbfdbc2b3690048c7d830296968919537e73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16402.exe

Filesize
468KB

MD5
b029002f3b8297585633f718e772c98c

SHA1
d9a7c62b0a1289024602b6986cb56452aa2a7bc2

SHA256
664b16253fae53827cd4b91ae904511edc599cdbca70d7b7c6d097604d4bf8ce

SHA512
30919d074b3a6635ada8887848764accc72bf340f4c17e5b7cb5a377a17e1440db7bb7c626609e0cceab091ef70464891293430dfc9606840af3598e5bbd0ea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe

Filesize
468KB

MD5
1feb3f96a0ae9c5938ede0e41fe36c1e

SHA1
fef7bb6ac4edc6f72a50bc5831855beb07f9bee9

SHA256
22b625a1cd7ecf888da11f7c82b2962fc4c0ea4cc4ef1383be586f07d4666403

SHA512
2cc73f88148a1159b480ec03e6c94b153801a4c4d8a20a19ff3b4cab16f7454ac572ff29982ca64525f4c129e9d8c24e62cb23f6bdb5fcaeaaf24dcb1c5239a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe

Filesize
468KB

MD5
90d56ef9ada0459080793650b654d628

SHA1
d25f2b903638c442b716e55366ff95b1f4e9e7d1

SHA256
28770dd689ef64250d8a3dbac82ccfb931d280d7a870008592c8deea48d7be1c

SHA512
1d02c93de07f112b4155b1b9d105b8e13681302d94b7e0152f0a5875cf7ccd7e046e7f5d2c5fc168e712ac14e3adce0e219195aac07a2ef6bc8292e1da82aeca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe

Filesize
468KB

MD5
28d9c9219d9c56c1518602a88f97eb31

SHA1
29a2358090e6a57a3a3d13e2184a4903bf39c2db

SHA256
b3dcf81ab10832830e05ac5c285446208bce914991c994f45f22febe3f9f91f1

SHA512
c1b227425a531c06478d619ef59ddfeed446ded9c8faacc970598dc3acf7840aef61951ff1ca06e9c26a5e5dd252251269f05e7f7e2a323f2c5ea2597c4570a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24866.exe

Filesize
468KB

MD5
9c8897d0ce067122b22b4c2ae0b1dd63

SHA1
319319a4936a842ee795372a712bb37c5c42482e

SHA256
870eaa7c93d64ccc8a6e9582b4ec1857ec8dd74259554e2379544f2285bf3e80

SHA512
e24c776880320761e1e753483fec068e03db9d473fda388fb3ab5669d9dad6a95a26426236a35ad8a9da509314ebc1be95df36bfaa3946451e5bfa862ce972a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28372.exe

Filesize
468KB

MD5
6d9bb3d8b80a200990745a942799e456

SHA1
9bdbaaa5869ee1fcc4f8066f0f514542539abf9e

SHA256
518975ac0f5f23c420a531900bc99229f5fda58f2a0d4fc19b4dc80693311adf

SHA512
ec16808af97198d1891b4cc06e554c5855f2b4258de60c65ba7c16818f0dbde1c92ea043776ac3c714a3f43323689d48431a290c35ca0ee864e5da7eca844a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28380.exe

Filesize
468KB

MD5
9dfb047768f6ac9ebef9ac4732d41996

SHA1
a729d92c3974f4e8e9a8efca0d75fee88959c897

SHA256
70f497cbd494b577fdf6d51bf1277598b0910670c9799d214a71426e1d99e1ba

SHA512
b914bb0e321971c20158e40bfe448890063001e200a2cea809bab3e425214a046e9a0570ad9c3a244fb942e0753e11b7db57b6cd3d04f19de2694fef1eae7a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe

Filesize
468KB

MD5
533a583759d4fb2bc7629666df9e2d4f

SHA1
416d7013a031f7f230288aa81b513e3c09432294

SHA256
55c749353867e12673c7ab57a308d8c690279d1162aebf2974e37fcbde97b910

SHA512
13a4f19a31adb940272fd289cc92e721a53623fa6465c3c3af6478262b455c7fca0378eb8c29c3313c33bc35d7b7cd5dcac2d72741e40927f4dd1278886977e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe

Filesize
468KB

MD5
0d3ddf6a3e96f6591b2d4717b0b270b0

SHA1
635bec5f0c2b802a00607232abfcb14931850f8a

SHA256
3bc05b1526a99604e32c1426018ad24aa78b77bcb94bbdc105ac13f768c6face

SHA512
1254d5d7e5a121c2fd73e211b4d46692e37f691a5a9bbdcd3eb51af84eeb5fd820889cadf189c6ed9375a4f839a3739640d6a22c1ef197ded61f0309ffe4086d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe

Filesize
468KB

MD5
f72f68386a73c906668f26dd3b5bb118

SHA1
fb2d2885d19ba058e338ae40f29bacfea08977e8

SHA256
11cca641f61b85c8237ad9c70ed442fc1f8e8f72dd03123628de66c79025085f

SHA512
390226e477c6cafe99329015b2275276f8e315e12c3bc9347afb0426f9578dabbce8f3a7d43ef693aa555d1df12feb8388fa28144b04fec88b5fec3ca864283e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe

Filesize
468KB

MD5
735c496736b54d93a3fcfc8d5c4b8eeb

SHA1
e53ef415464e5b0da44b3a972069bd06cc168d20

SHA256
063dad7d31d4091135ac58f19527305ad330262c42311b88698b59f90b183c7d

SHA512
279031fd3d0d99469de32e402213dacdeeae5a71edebb8b13b329bde3c323d31a908cea4fc084d14d4c75506f5749bbdb0b4e7ab19c01ba880c477732fcdbaef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe

Filesize
468KB

MD5
0163919ad099d61f3e074b24dd6f5ee9

SHA1
c535c6efd2a731e1e8871fdbc06a69e4525a993d

SHA256
18b2ba03081db0c4a997994df81f645a5ebdc503a69c47e6a33ef543407d59f7

SHA512
5dad4d572ef294491e8aa77372f1eb9e13e2edbf66aed8a0b477385b900f17eac5a7e29e3e1240ab85c924fe11e545ea7c81b62ded1ce18b98191ce8b6c15f59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38986.exe

Filesize
468KB

MD5
f260820dcb85001858f847a2cae1f162

SHA1
c4c01dc7e81db644891f6c142f214af58325483d

SHA256
9fbce165b44bd2ce19f49b41b973afec150d05ebc6a7c1d02858555de5837ed7

SHA512
143599ed00a3aac212b385d6a828ee1f2a83ca9e77dbe58de3cc2990dcdf66bf6dfda0cd582ba736955b7363058a3c1f7e78d79163c807126fe7417d62df3046

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe

Filesize
468KB

MD5
d059209daf4ada91bb2682a9aa7c7d55

SHA1
2957143b3095738b27bd3b3a46115eee2910350b

SHA256
4380dc3e9aaeaf82db13cf5f62ed17609dfe5f5884b16eff4792c3d7ed747980

SHA512
4f5d7ec0d6c3e12bde0c4a4b18183fd9d20dfbd7af126ebd2701c7a70bd29410165f2ba1e0c2bba3ec701c58c37ccbdf9a7d9b0b2e65cd81693f456f49c2b87d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41186.exe

Filesize
468KB

MD5
52e06c102161a345c964f3c80eb75c17

SHA1
bb5f066ed306e143da5848055e4b3523974c79ca

SHA256
79f0e1f189c69a8abcc4f1b094957280775d42c7c1129b078498466243f2d540

SHA512
a17958fe7f45aa1ec94f3b07224e660c5f2800859f2db9159a7a10a4a8efb1be9f301a2093ae33de9f2bbd8dd11243e27a0220ebbba0b355586753aa0989d264

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe

Filesize
468KB

MD5
eab35dab5620a5c20f1714016d927b94

SHA1
b5899b5ba1e32dac2a187874ee56160ca22c73e0

SHA256
f8c41bda12d83deb3a29f4db13370fb031dcba119a3446ee96fde8944b1a76a8

SHA512
06ff89ba95eb0992e76283f25e15bc45096b77464124d84e55ec0d728d353467d6df5284825009ff75071aa70f67d72e5c9516a1d0c5d2c3b00ddaf7b38206cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe

Filesize
468KB

MD5
2b5b64c3c5b02b159d5b36facf50b343

SHA1
99c116a97ad8b4b524e6cf087f650e3f4dab556e

SHA256
71cd1189ba2bedbc93400973b9b3d2ad7b035197f5d05f3a42c4d63d64bdd1b6

SHA512
898b0f4216843c6aaedfbf1c9f5790e97bf9e4241fe0c8b8ba82014a7e2d39462c1f5970ff8552f89ad01032ba00b7785e055d2d97e331c507de1316b45c940c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45116.exe

Filesize
468KB

MD5
461bb0db92ba36caba972e76ee6c05f7

SHA1
b3591b685b24cad69fbd9fdd84f0c53f2f9c72eb

SHA256
45640087116250f0a98518f9180c0031f6b0a92227f0c777c865ecf280f87949

SHA512
e17465f2e6cf80db63a1f770bfa8555d4afadf8421e3fd5b8fe50ed41cf4ed96ffc77e395d533732061ae1b6603f829b2f455950056d0eef1155f2131078b2f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe

Filesize
468KB

MD5
b8c6c2b4d6b2d2579842272ce63be9f8

SHA1
939d4aa793d64699e15e5452fecb4c03beea3db7

SHA256
f352e4a50966e403bf8e80889e53320d60c609bcb3d53f49576aa893a17a8a6b

SHA512
0916d14aaa23f0e2987f03de37e55f4139e18cd33ad6e385a6371d603567ea4c18a8134b3c30fdf4a51104958f93a302019e84fdb30320592c46f468c8820aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47036.exe

Filesize
468KB

MD5
db8ee12ec78fdebf9f5f7f03d09edb01

SHA1
701717b7bb04f4176828dc656feb8d1a4c33113d

SHA256
fd02c7b360e3606c418bb01ca251925ef8c21752a9af27f722bfe1509429a022

SHA512
21ec54020ac1d6ac39b2b5493c84fc693cee6ff6ddd65ea6496737c0965177a6c7e17f643a7bd59bab5b6af425b32c4d285604a366b22098517dbdcbd111b78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe

Filesize
468KB

MD5
6000271d4c45fa983a91cdb9cef95a82

SHA1
ab82a96268b86cd7f0d56a60b4d42cb524794847

SHA256
9134ab1b8a2c39d0f48e7d61ffdba1d2615359a1ef31165362bcf3d17a0ed55e

SHA512
1696bf79cc8b1b52ceef8e0a856cb948dc16212082e7385917d0d8a955691ae47062b810ebc6f1f4a30a84334470d6c124974508255db40b76f727557de1a4f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe

Filesize
468KB

MD5
48ae739e602e3de0b385147ff11b3214

SHA1
3a6b920bdfe525271395bf6766e3b1d0735cd543

SHA256
1c256e2456c3b5e6de896befffc5fdfed548d36733362da4f3d7b8cc23689a20

SHA512
849ed4b9fb05735a013d6a7f55116386e158d746cd97b154180edf796f8ac4fd2c119beaae60ed7aac64f7ff02b8c097e00ddc43e842d8546ca5698b41ddb3b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe

Filesize
468KB

MD5
42d5e343c74ccdf705e26ee309c38782

SHA1
347041b9ab24edfb6fce6894614e9600228ff96f

SHA256
d7d5182ea5bdfe3164ecbeea5f38ab2339149097d705fb35a33d809df9ebe6cf

SHA512
83f35b1c30be7cf4ffabb3757b3446b4b7ab39f9a09dd5683a3db1b7408bae375a5708761b28a2bd0fe39428a02eef32f5b0882ea2daf6ac0e586d3dc4035d78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52723.exe

Filesize
468KB

MD5
5eebad3ca8b23db35b4332ed32a3602e

SHA1
5927311a9140dde204471096a4fb6c3526d0abab

SHA256
79c6320d6e3bfabd1c54054d5d7d3ea4009a926f2ff99ca673b98dd212af12bc

SHA512
15db90f4fa330ee1d28b42198c8439d1d59f3bd58fb60718c783a115c127a931c7e7811e71069552c94c4cb03f48cf555c4ba0a6caf59f4cd441dc17db275ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe

Filesize
468KB

MD5
90f3de98851590e5f6e8e8c2a4272e5c

SHA1
9dda507bccaac10ccef7f44ff68df9b5664125cd

SHA256
1692d815e642d624f3fe6ff65add9014b3bc2309d5436097738e478fffa9c6b4

SHA512
5465f5b733421e8657fde8ef5a961488029f1c1c4ed3ead70b95935cb4c959ac6be5f9846b1e58450bd49f63de651a81050e70028ecace5197257cc7e373b6e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61068.exe

Filesize
468KB

MD5
1b35e833d2cdfc3788215114e44eed0e

SHA1
fedfff836c9a61ed2a24f687d10f7d566e3a9630

SHA256
e6ea5e7121a1a07c751ff3464fe58d078e88a91d9320ffd320b3389a6f15ed02

SHA512
9be6c20264bdc6f359530900fdc9c25a500aa7406a46314d1bee5894c03747e5b045d18b82a69ef4c93a877a8081cefb8820cd0a8fd4a26596256a0107dc75ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe

Filesize
468KB

MD5
56c24a8028c548cb829aa20e9d777fa9

SHA1
94a6d5672123bf14b78d89320aa5a08dba84c0e7

SHA256
31e29cac0f3dd7acf4efdffcf453af1f8c61c1d694219b9fe190ea17f3defa53

SHA512
cfcdbfdf8577935440ec846b1135aa5bd040325f36fa5519076b1748f3c7a0d6240578b1ece0e33dacb02b8d7ed6605bd97489a217ddd5125bf7d34a7fe552cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62427.exe

Filesize
468KB

MD5
a97c319e6ff83d448b98624fbebfe2ae

SHA1
db94c19efefba48d34d0caf53a6cb589e21097bf

SHA256
2cd85ef61d39655a1f0bfc3db57f578c8cb539bcbb910541a3d1caeb1cd099f4

SHA512
e620554d99973e2886492ff56acc1b0d9f5b61cfe736c28c90fa721c49f4b890313b1ec815262cdc3d13d8f8bf2ce5455f65f6f5d333ffacc768341e90bd2baa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-921.exe

Filesize
468KB

MD5
0cd48a0a12c06fa56aa3535683125a64

SHA1
1743a1c1122ede583f21a7e7b480af5abb854df6

SHA256
91be2aa2196bfbee90f3ebc0508271c10485a5d1e9ad01a8e47a2b659728a893

SHA512
fa9b875c3aab5d52b92ef9a8af452cbbb00e08a19a64a478e5bf05f1f4c83f5ad40425e5015f8b70d323486511511ae5452a8ab3736f01f5214330081e8e68c6

Download Submit
memory/60-136-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/244-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/456-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1064-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1188-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1188-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1404-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1496-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1668-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1672-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1684-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2096-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2116-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-2588-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3028-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3080-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3116-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3136-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3148-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3200-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3268-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3280-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3384-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3536-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3612-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3676-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3692-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3776-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3844-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4004-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4140-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4148-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4156-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4160-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4336-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4412-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4584-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4716-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4760-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4792-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4832-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4980-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5104-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5124-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5652-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5660-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5696-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5704-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5716-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5760-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5808-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5824-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5848-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5860-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5892-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5908-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5988-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6000-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6064-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15336-2459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads