5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5f

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe
Size

468KB
MD5

2d85074c325a438cf9aaee5cddec8960
SHA1

3e47c92f1806abf036307882e998e7390d8d331e
SHA256

5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5f
SHA512

30e83d8fff96c767be87e4cd1e44788ba8bf69c21c69cefb3481ea0476c3850df0ff5d73e8a65307f3e814808463de3679f234cd75de656781d4379ef4e4a2e7
SSDEEP

3072:KqtnoweNjj8U6bYYfz5jYf5EChSvIpLnmHePFsYn1BsXhfcqNULlR:KqJoVQU6zf1jYfg0dz1BsxEqNU

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4936	Unicorn-25139.exe
1384	Unicorn-23337.exe
2304	Unicorn-43203.exe
2276	Unicorn-46314.exe
4316	Unicorn-642.exe
4700	Unicorn-58011.exe
4308	Unicorn-47797.exe
1372	Unicorn-14.exe
668	Unicorn-55337.exe
972	Unicorn-36387.exe
1984	Unicorn-7606.exe
3732	Unicorn-53278.exe
3600	Unicorn-7341.exe
2196	Unicorn-7606.exe
4632	Unicorn-36609.exe
3152	Unicorn-26595.exe
1100	Unicorn-43485.exe
3568	Unicorn-23663.exe
2156	Unicorn-61166.exe
3396	Unicorn-60419.exe
4076	Unicorn-64238.exe
704	Unicorn-55759.exe
1008	Unicorn-48146.exe
1180	Unicorn-59081.exe
4864	Unicorn-2474.exe
2688	Unicorn-57797.exe
3392	Unicorn-23641.exe
3292	Unicorn-29859.exe
4212	Unicorn-21425.exe
1484	Unicorn-46195.exe
1096	Unicorn-35981.exe
3508	Unicorn-50279.exe
2752	Unicorn-30413.exe
2112	Unicorn-33559.exe
3648	Unicorn-50450.exe
4916	Unicorn-50450.exe
3256	Unicorn-30029.exe
5092	Unicorn-1462.exe
3632	Unicorn-30797.exe
5048	Unicorn-14098.exe
824	Unicorn-10014.exe
3872	Unicorn-63107.exe
744	Unicorn-48809.exe
4780	Unicorn-54939.exe
2232	Unicorn-25264.exe
4484	Unicorn-10709.exe
2940	Unicorn-10974.exe
5020	Unicorn-64067.exe
3312	Unicorn-48286.exe
2340	Unicorn-38801.exe
4540	Unicorn-47731.exe
3296	Unicorn-26349.exe
1644	Unicorn-31949.exe
3804	Unicorn-3730.exe
4420	Unicorn-44742.exe
2272	Unicorn-31743.exe
1532	Unicorn-43995.exe
3460	Unicorn-16153.exe
3228	Unicorn-7628.exe
4292	Unicorn-8390.exe
3488	Unicorn-57399.exe
4964	Unicorn-16751.exe
4796	Unicorn-4233.exe
4852	Unicorn-63905.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5544	4484	WerFault.exe	134
7144	5132	WerFault.exe	182

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33684.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16064	dwm.exe
Token: SeChangeNotifyPrivilege	16064	dwm.exe
Token: 33	16064	dwm.exe
Token: SeIncBasePriorityPrivilege	16064	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe
4936	Unicorn-25139.exe
2304	Unicorn-43203.exe
1384	Unicorn-23337.exe
2276	Unicorn-46314.exe
4316	Unicorn-642.exe
4700	Unicorn-58011.exe
4308	Unicorn-47797.exe
1372	Unicorn-14.exe
972	Unicorn-36387.exe
668	Unicorn-55337.exe
3600	Unicorn-7341.exe
3732	Unicorn-53278.exe
2196	Unicorn-7606.exe
1984	Unicorn-7606.exe
4632	Unicorn-36609.exe
3152	Unicorn-26595.exe
1100	Unicorn-43485.exe
3568	Unicorn-23663.exe
3396	Unicorn-60419.exe
2156	Unicorn-61166.exe
4076	Unicorn-64238.exe
3392	Unicorn-23641.exe
2688	Unicorn-57797.exe
1180	Unicorn-59081.exe
1008	Unicorn-48146.exe
704	Unicorn-55759.exe
4864	Unicorn-2474.exe
3292	Unicorn-29859.exe
4212	Unicorn-21425.exe
3508	Unicorn-50279.exe
2752	Unicorn-30413.exe
1484	Unicorn-46195.exe
1096	Unicorn-35981.exe
2112	Unicorn-33559.exe
3648	Unicorn-50450.exe
4916	Unicorn-50450.exe
3256	Unicorn-30029.exe
5092	Unicorn-1462.exe
3632	Unicorn-30797.exe
5048	Unicorn-14098.exe
824	Unicorn-10014.exe
744	Unicorn-48809.exe
4780	Unicorn-54939.exe
3872	Unicorn-63107.exe
5020	Unicorn-64067.exe
4484	Unicorn-10709.exe
2940	Unicorn-10974.exe
2232	Unicorn-25264.exe
1644	Unicorn-31949.exe
3312	Unicorn-48286.exe
2340	Unicorn-38801.exe
3296	Unicorn-26349.exe
4540	Unicorn-47731.exe
3804	Unicorn-3730.exe
2272	Unicorn-31743.exe
4420	Unicorn-44742.exe
1532	Unicorn-43995.exe
3488	Unicorn-57399.exe
3228	Unicorn-7628.exe
3460	Unicorn-16153.exe
4292	Unicorn-8390.exe
4964	Unicorn-16751.exe
3328	Unicorn-59245.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 4936	3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe	82
PID 3272 wrote to memory of 4936	3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe	82
PID 3272 wrote to memory of 4936	3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe	82
PID 3272 wrote to memory of 1384	3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe	83
PID 3272 wrote to memory of 1384	3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe	83
PID 3272 wrote to memory of 1384	3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe	83
PID 4936 wrote to memory of 2304	4936	Unicorn-25139.exe	84
PID 4936 wrote to memory of 2304	4936	Unicorn-25139.exe	84
PID 4936 wrote to memory of 2304	4936	Unicorn-25139.exe	84
PID 4936 wrote to memory of 2276	4936	Unicorn-25139.exe	86
PID 4936 wrote to memory of 2276	4936	Unicorn-25139.exe	86
PID 4936 wrote to memory of 2276	4936	Unicorn-25139.exe	86
PID 2304 wrote to memory of 4316	2304	Unicorn-43203.exe	85
PID 2304 wrote to memory of 4316	2304	Unicorn-43203.exe	85
PID 2304 wrote to memory of 4316	2304	Unicorn-43203.exe	85
PID 1384 wrote to memory of 4700	1384	Unicorn-23337.exe	87
PID 1384 wrote to memory of 4700	1384	Unicorn-23337.exe	87
PID 1384 wrote to memory of 4700	1384	Unicorn-23337.exe	87
PID 3272 wrote to memory of 4308	3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe	88
PID 3272 wrote to memory of 4308	3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe	88
PID 3272 wrote to memory of 4308	3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe	88
PID 2276 wrote to memory of 1372	2276	Unicorn-46314.exe	89
PID 2276 wrote to memory of 1372	2276	Unicorn-46314.exe	89
PID 2276 wrote to memory of 1372	2276	Unicorn-46314.exe	89
PID 4936 wrote to memory of 668	4936	Unicorn-25139.exe	90
PID 4936 wrote to memory of 668	4936	Unicorn-25139.exe	90
PID 4936 wrote to memory of 668	4936	Unicorn-25139.exe	90
PID 4316 wrote to memory of 972	4316	Unicorn-642.exe	91
PID 4316 wrote to memory of 972	4316	Unicorn-642.exe	91
PID 4316 wrote to memory of 972	4316	Unicorn-642.exe	91
PID 4700 wrote to memory of 1984	4700	Unicorn-58011.exe	93
PID 4700 wrote to memory of 1984	4700	Unicorn-58011.exe	93
PID 4700 wrote to memory of 1984	4700	Unicorn-58011.exe	93
PID 3272 wrote to memory of 3600	3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe	92
PID 3272 wrote to memory of 3600	3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe	92
PID 3272 wrote to memory of 3600	3272	5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe	92
PID 4308 wrote to memory of 2196	4308	Unicorn-47797.exe	95
PID 4308 wrote to memory of 2196	4308	Unicorn-47797.exe	95
PID 4308 wrote to memory of 2196	4308	Unicorn-47797.exe	95
PID 2304 wrote to memory of 3732	2304	Unicorn-43203.exe	94
PID 2304 wrote to memory of 3732	2304	Unicorn-43203.exe	94
PID 2304 wrote to memory of 3732	2304	Unicorn-43203.exe	94
PID 1384 wrote to memory of 4632	1384	Unicorn-23337.exe	98
PID 1384 wrote to memory of 4632	1384	Unicorn-23337.exe	98
PID 1384 wrote to memory of 4632	1384	Unicorn-23337.exe	98
PID 1372 wrote to memory of 3152	1372	Unicorn-14.exe	99
PID 1372 wrote to memory of 3152	1372	Unicorn-14.exe	99
PID 1372 wrote to memory of 3152	1372	Unicorn-14.exe	99
PID 2276 wrote to memory of 1100	2276	Unicorn-46314.exe	100
PID 2276 wrote to memory of 1100	2276	Unicorn-46314.exe	100
PID 2276 wrote to memory of 1100	2276	Unicorn-46314.exe	100
PID 972 wrote to memory of 3568	972	Unicorn-36387.exe	102
PID 972 wrote to memory of 3568	972	Unicorn-36387.exe	102
PID 972 wrote to memory of 3568	972	Unicorn-36387.exe	102
PID 4316 wrote to memory of 2156	4316	Unicorn-642.exe	103
PID 4316 wrote to memory of 2156	4316	Unicorn-642.exe	103
PID 4316 wrote to memory of 2156	4316	Unicorn-642.exe	103
PID 668 wrote to memory of 3396	668	Unicorn-55337.exe	104
PID 668 wrote to memory of 3396	668	Unicorn-55337.exe	104
PID 668 wrote to memory of 3396	668	Unicorn-55337.exe	104
PID 4936 wrote to memory of 4076	4936	Unicorn-25139.exe	105
PID 4936 wrote to memory of 4076	4936	Unicorn-25139.exe	105
PID 4936 wrote to memory of 4076	4936	Unicorn-25139.exe	105
PID 3732 wrote to memory of 704	3732	Unicorn-53278.exe	107

C:\Users\Admin\AppData\Local\Temp\5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe
"C:\Users\Admin\AppData\Local\Temp\5f7f7772fb280a55aaa6b41defd9aa05f09488722f878e781b10c8ea584f6c5fN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25139.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25139.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43203.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23663.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53507.exe
        8⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
        9⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7394.exe
        10⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe
        10⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
        10⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-241.exe
        10⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        10⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        9⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        9⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        9⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        9⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44410.exe
        8⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
        9⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        9⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46054.exe
        9⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        8⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
        9⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5649.exe
        9⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe
        8⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37573.exe
        8⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe
        7⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22807.exe
        9⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
        9⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe
        9⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
        9⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        8⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exe
        8⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        8⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29220.exe
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17304.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
        8⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        8⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        8⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        8⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        7⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4624.exe
        7⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29403.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33684.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37171.exe
        7⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23797.exe
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
        9⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        9⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
        9⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50601.exe
        9⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        8⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
        8⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25520.exe
        8⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
        8⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64950.exe
        8⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        7⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe
        7⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38967.exe
        8⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
        8⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        8⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5981.exe
        8⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
        7⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        7⤵
        
        PID:16772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe
        6⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31301.exe
        7⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe
        7⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        7⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13465.exe
        6⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51131.exe
        6⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10014.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61115.exe
        9⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        9⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
        9⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38561.exe
        8⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
        8⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47519.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        8⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        8⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
        8⤵
        
        PID:16840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8908.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        7⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
        8⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44478.exe
        8⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19576.exe
        8⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        7⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe
        7⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        7⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20692.exe
        7⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        7⤵
        
        PID:16860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        6⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        6⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        8⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
        8⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
        8⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8104.exe
        7⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        7⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
        6⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7512.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        6⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        6⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
        6⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17047.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        7⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29604.exe
        7⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        6⤵
        
        PID:14836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
        6⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9600.exe
        5⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24364.exe
        5⤵
        
        PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64067.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29963.exe
        7⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28827.exe
        9⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
        9⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26820.exe
        9⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        8⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
        8⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60701.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48553.exe
        7⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62999.exe
        7⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3273.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        7⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17239.exe
        8⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30327.exe
        9⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
        9⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
        8⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
        8⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22012.exe
        8⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        7⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44670.exe
        7⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        7⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        6⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
        7⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        7⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
        7⤵
        
        PID:16396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44165.exe
        6⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41811.exe
        6⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54659.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-710.exe
        8⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        8⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16577.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe
        8⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17600.exe
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55221.exe
        6⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51362.exe
        6⤵
        
        PID:16744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17008.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe
        6⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        6⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        6⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        6⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21926.exe
        5⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26476.exe
        5⤵
        
        PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        6⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
        8⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
        9⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3445.exe
        9⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
        9⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
        8⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50764.exe
        8⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe
        8⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15977.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        7⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38981.exe
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46434.exe
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28028.exe
        6⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exe
        6⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe
        5⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13294.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61115.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        7⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8476.exe
        7⤵
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        6⤵
        
        PID:13840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37062.exe
        5⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43353.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1929.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22158.exe
        5⤵
        
        PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 724
        5⤵
        Program crash
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46689.exe
      4⤵
      PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32823.exe
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27324.exe
        6⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48549.exe
        6⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        5⤵
        
        PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
      4⤵
      PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55652.exe
      4⤵
      PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51893.exe
      4⤵
      PID:6568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46314.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26595.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43995.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        8⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        9⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7742.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        10⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11408.exe
        10⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9537.exe
        9⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
        9⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5405.exe
        9⤵
        
        PID:17072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40813.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        8⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        8⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe
        8⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30173.exe
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45967.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        9⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        9⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20445.exe
        8⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        8⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46325.exe
        8⤵
        
        PID:16832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41181.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
        7⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe
        7⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe
        7⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16153.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        8⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45365.exe
        8⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        7⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3225.exe
        8⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        8⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46153.exe
        7⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        7⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10184.exe
        6⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29543.exe
        7⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        7⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        7⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30622.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55930.exe
        6⤵
        
        PID:12560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22542.exe
        6⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30413.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8390.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        9⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        9⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64794.exe
        8⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46014.exe
        8⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        8⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46317.exe
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        7⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        7⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        7⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16677.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        7⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58021.exe
        7⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        7⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        6⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
        6⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63905.exe
        5⤵
        Executes dropped EXE
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23331.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
        8⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe
        8⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11408.exe
        8⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        7⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61389.exe
        7⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46054.exe
        7⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        6⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15313.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
        6⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3605.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        6⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1421.exe
        7⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        7⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        6⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        5⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29299.exe
        6⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        7⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        7⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        6⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        6⤵
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13033.exe
        6⤵
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
        6⤵
        
        PID:16696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55302.exe
        5⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
        6⤵
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        6⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9534.exe
        5⤵
        
        PID:12492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5288.exe
        5⤵
        
        PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58219.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe
        9⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15264.exe
        9⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
        9⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
        8⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53797.exe
        8⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59266.exe
        8⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28369.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        7⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        7⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        7⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44933.exe
        6⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        7⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33838.exe
        7⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50570.exe
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6352.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20694.exe
        6⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29557.exe
        5⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37031.exe
        7⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56626.exe
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46014.exe
        7⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17729.exe
        7⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52718.exe
        6⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8088.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55413.exe
        6⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe
        6⤵
        
        PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27828.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57311.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4325.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
        6⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe
        5⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
        5⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-970.exe
        5⤵
        
        PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35981.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57399.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39091.exe
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11130.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe
        7⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15474.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40385.exe
        6⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63383.exe
        6⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        6⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30327.exe
        7⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        7⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        5⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44117.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        6⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        5⤵
        
        PID:10272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
        5⤵
        
        PID:15020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
        5⤵
        
        PID:15512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
      4⤵
      Executes dropped EXE
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
        5⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59906.exe
        6⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41149.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31056.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        5⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37727.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62693.exe
      4⤵
      PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10342.exe
        5⤵
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55042.exe
        5⤵
        
        PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
      4⤵
      PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
      4⤵
      PID:13952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41276.exe
      4⤵
      PID:16388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55337.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60419.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1462.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        6⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13694.exe
        8⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19921.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        8⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21109.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
        7⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15888.exe
        7⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        7⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        6⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61115.exe
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        7⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe
        7⤵
        
        PID:16640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe
        6⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46709.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        5⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        7⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        7⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31056.exe
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        6⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        6⤵
        
        PID:11184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36713.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5649.exe
        6⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23368.exe
        5⤵
        
        PID:14016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        5⤵
        
        PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30797.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
        5⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
        7⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45962.exe
        7⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        7⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43518.exe
        6⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
        6⤵
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
        5⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5200.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59441.exe
        5⤵
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37031.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
      4⤵
      PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29143.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        6⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        6⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe
        5⤵
        
        PID:11280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22978.exe
      4⤵
      PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        5⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19420.exe
        5⤵
        
        PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
      4⤵
      PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2890.exe
        5⤵
        
        PID:14408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
      4⤵
      PID:12480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
      4⤵
      PID:6356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54467.exe
        5⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        7⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
        7⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15017.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5981.exe
        6⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
        6⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        5⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        5⤵
        
        PID:14024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        5⤵
        
        PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
      4⤵
      PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15022.exe
        5⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        6⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe
        5⤵
        
        PID:11348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
        5⤵
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        5⤵
        
        PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54549.exe
      4⤵
      PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
      4⤵
      PID:10696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
      4⤵
      PID:13668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23857.exe
      4⤵
      PID:16184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62423.exe
      4⤵
      PID:11872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38801.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
      4⤵
      PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32371.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63139.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        6⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe
        5⤵
        
        PID:13064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16577.exe
        5⤵
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26096.exe
        5⤵
        
        PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38981.exe
      4⤵
      PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46434.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36196.exe
      4⤵
      PID:13376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45357.exe
      4⤵
      PID:9292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63018.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16035.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52947.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
        5⤵
        
        PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31056.exe
      4⤵
      PID:8972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
      4⤵
      PID:14572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58147.exe
      4⤵
      PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9938.exe
    3⤵
    PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
      4⤵
      PID:11380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60814.exe
      4⤵
      PID:14872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33172.exe
      4⤵
      PID:15912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24552.exe
    3⤵
    PID:9996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
    3⤵
    PID:13972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
    3⤵
    PID:8712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12401.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10170.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36419.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        8⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        8⤵
        
        PID:18092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        7⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
        7⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        7⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        6⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe
        7⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        7⤵
        
        PID:16404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37498.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
        6⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33489.exe
        6⤵
        
        PID:16036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61431.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37991.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        8⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        8⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        8⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe
        8⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64794.exe
        7⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46014.exe
        7⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        7⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44550.exe
        6⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35717.exe
        6⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23482.exe
        6⤵
        
        PID:14332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
        6⤵
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17165.exe
        5⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41551.exe
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
        6⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
        5⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32158.exe
        5⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        5⤵
        
        PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1758.exe
        6⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20975.exe
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16471.exe
        8⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        8⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50025.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4581.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
        7⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        7⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21429.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe
        7⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14877.exe
        7⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        7⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16745.exe
        6⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe
        6⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
        5⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe
        6⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53715.exe
        7⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40061.exe
        7⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
        7⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43605.exe
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        6⤵
        
        PID:13224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16577.exe
        6⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16776.exe
        6⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8892.exe
        5⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37817.exe
        6⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64693.exe
        6⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
        5⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        5⤵
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18095.exe
        5⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20171.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6709.exe
        7⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        7⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
        6⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56175.exe
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6801.exe
        6⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30674.exe
        5⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe
        5⤵
        
        PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
      4⤵
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3746.exe
        6⤵
        
        PID:9672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        6⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47306.exe
        5⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe
        5⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
        5⤵
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
      4⤵
      PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17779.exe
        5⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
        5⤵
        
        PID:12352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
        5⤵
        
        PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10377.exe
      4⤵
      PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30531.exe
      4⤵
      PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
      4⤵
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55785.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29859.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26071.exe
        6⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 720
        7⤵
        Program crash
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55458.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15680.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36997.exe
        6⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7357.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
        7⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54154.exe
        7⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        7⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe
        5⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43850.exe
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
        5⤵
        
        PID:13400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23139.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49475.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        7⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        7⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        7⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15785.exe
        6⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62774.exe
        6⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55842.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13239.exe
        6⤵
        
        PID:15760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        6⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19781.exe
        5⤵
        
        PID:13932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8608.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe
        5⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        5⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
        5⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49441.exe
        5⤵
        
        PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38535.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
      4⤵
      PID:10496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55650.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exe
      4⤵
      PID:3668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21425.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31743.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        6⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        5⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe
        6⤵
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60573.exe
        6⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        6⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44426.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        5⤵
        
        PID:13984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        5⤵
        
        PID:8328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
      4⤵
      PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
        5⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41685.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
        5⤵
        
        PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43850.exe
      4⤵
      PID:10564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
      4⤵
      PID:14300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53910.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7628.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59319.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        5⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        5⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7912.exe
        5⤵
        
        PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38021.exe
      4⤵
      PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43103.exe
        5⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        5⤵
        
        PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
      4⤵
      PID:10684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
      4⤵
      PID:13684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49825.exe
      4⤵
      PID:7756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9541.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
      4⤵
      PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
      4⤵
      PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
      4⤵
      PID:14308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8416.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe
    3⤵
    PID:7092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48392.exe
    3⤵
    PID:12160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
    3⤵
    PID:5864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47731.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50383.exe
        6⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        8⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18425.exe
        8⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31056.exe
        7⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe
        7⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe
        7⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38021.exe
        6⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17831.exe
        7⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
        7⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        7⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56565.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        6⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58723.exe
        6⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-466.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35459.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
        7⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        6⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
        6⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        6⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4040.exe
        5⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
        5⤵
        
        PID:9908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        5⤵
        
        PID:13992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        5⤵
        
        PID:9612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31949.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        5⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3974.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        7⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
        7⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19205.exe
        6⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50939.exe
        6⤵
        
        PID:15152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36541.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        5⤵
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        5⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        5⤵
        
        PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        5⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10570.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
        5⤵
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24745.exe
        5⤵
        
        PID:8136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58530.exe
      4⤵
      PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
      4⤵
      PID:14128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28671.exe
      4⤵
      PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61313.exe
      4⤵
      PID:8236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        5⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14009.exe
        7⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41049.exe
        6⤵
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12493.exe
        6⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25770.exe
        5⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53367.exe
        5⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
        5⤵
        
        PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60450.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
        5⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49927.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56142.exe
        6⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31056.exe
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        5⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5438.exe
        5⤵
        
        PID:9788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
      4⤵
      PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38059.exe
        5⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1125.exe
      4⤵
      PID:10212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31920.exe
      4⤵
      PID:14060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
      4⤵
      PID:7976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42703.exe
      4⤵
      PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44691.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
        5⤵
        
        PID:14192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        5⤵
        
        PID:16752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe
      4⤵
      PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55229.exe
      4⤵
      PID:12432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe
      4⤵
      PID:644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11572.exe
    3⤵
    PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
      4⤵
      PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
      4⤵
      PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
      4⤵
      PID:848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10377.exe
    3⤵
    PID:9092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30531.exe
    3⤵
    PID:12364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
    3⤵
    PID:16092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7341.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7341.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45147.exe
      4⤵
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50871.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25023.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41778.exe
        6⤵
        
        PID:16680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47306.exe
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
        5⤵
        
        PID:12848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58037.exe
        5⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        5⤵
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33309.exe
      4⤵
      PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe
        5⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32404.exe
        5⤵
        
        PID:7292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29712.exe
      4⤵
      PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38666.exe
      4⤵
      PID:12312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46325.exe
      4⤵
      PID:16812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
    3⤵
    PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
      4⤵
      PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe
        5⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        5⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37637.exe
      4⤵
      PID:8240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8192.exe
      4⤵
      PID:11884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
      4⤵
      PID:12488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe
      4⤵
      PID:9476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39314.exe
    3⤵
    PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45443.exe
      4⤵
      PID:8580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24005.exe
      4⤵
      PID:10808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
      4⤵
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe
      4⤵
      PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42481.exe
    3⤵
    PID:9048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57082.exe
    3⤵
    PID:12860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38495.exe
    3⤵
    PID:16884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34217.exe
    3⤵
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
      4⤵
      PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
        5⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34938.exe
        6⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
        6⤵
        
        PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        5⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55637.exe
        5⤵
        
        PID:16372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
        5⤵
        
        PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47306.exe
      4⤵
      PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
      4⤵
      PID:7392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
    3⤵
    PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
      4⤵
      PID:12836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35773.exe
      4⤵
      PID:3892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
    3⤵
    PID:8764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
    3⤵
    PID:12764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
    3⤵
    PID:8348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59127.exe
    3⤵
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
      4⤵
      PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45635.exe
        5⤵
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
      4⤵
      PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe
      4⤵
      PID:12896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
    3⤵
    PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35909.exe
    3⤵
    PID:10144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12521.exe
    3⤵
    PID:12172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40577.exe
    3⤵
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
    3⤵
    PID:2104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46259.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46259.exe
  2⤵
  PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
    3⤵
    PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
      4⤵
      PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47654.exe
      4⤵
      PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32980.exe
      4⤵
      PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
    3⤵
    PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42009.exe
    3⤵
    PID:15072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62078.exe
    3⤵
    PID:11000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12912.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12912.exe
  2⤵
  PID:7124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64142.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64142.exe
  2⤵
  PID:9976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
  2⤵
  PID:13960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65306.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65306.exe
  2⤵
  PID:9624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4484 -ip 4484
1⤵
PID:6016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5132 -ip 5132
1⤵
PID:6776

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14.exe

Filesize
468KB

MD5
5d3f57ac931645b96c77feeb36a1c6f3

SHA1
f7a2acfcd1bdc777086596320764c597d32d7088

SHA256
0b27643a79f838429675efec82854ed4391e92e2bdc3a863ee71c5a4d17ec998

SHA512
d87448c6cdf5880ac054265f398edf54195bb69f2ae0d918991c06ab2843bd5d5c8130560f3e074d34d2be6a054e01615d1bdeca87882a8611a99084a7cf24bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21425.exe

Filesize
468KB

MD5
1ce1e78e66b887d98be0c02a56c76677

SHA1
c1471120baf418cac69190b7b09e799eebb9ec82

SHA256
963020f3dd0d4adda9969adf594b188543da5e356af66edba7a481f7c42a9a5f

SHA512
b02c0a72385f8bc67908977a5218f2ed941b354389f4b68390f58ee056e4005d2bf258afff48d1d3bc96286ce582b2a7deb7fc3b7f6f7c34c40e0307fc88a67f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe

Filesize
468KB

MD5
20928d59e9feb7d638348661f38949db

SHA1
207ed777d2c36124227206aacc72326ad43900c1

SHA256
aabf2ef3f1f1ffb53d57982df5d7760684892ce13429cf8e84ba3decb8beddcf

SHA512
75015465b03ffc25affeb1df7ef01398061467f9e817842de78f737e72531e6ab7212a1763944dc53e36b9c3c72c92db7212b384893ab6559f4a53c439b8ae70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe

Filesize
468KB

MD5
5244404290f7edd03315a214db20e1b6

SHA1
7464c0a353024be598e7e610ab3d31abeb84d62c

SHA256
106b731fdf4c3fa13eb220c06957e7e32549487c033021edc53cddaaa1766e76

SHA512
4b292b5a1b010b59dc9fb6fa04f28c1592b1e110da18073ac77ef547ae8d590e320d3541443f0041650a4bd3b67dcf208cc1897f3492ee9744309094dc1b8334

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23663.exe

Filesize
468KB

MD5
793891b8b3aa0933bcc062663c416e32

SHA1
7cb98b5e382ec05b6433af39e23fa8b993f98f3c

SHA256
1cd06aa9d07cb82c42b26bddaac7d2542c02e239e83d1bfb43e77ed67ddf144d

SHA512
f6d54f21a71428f919453ad967068e324875e78e350674f6beafa98bfcd5bed1fd6e51eeaa2a08f0dc283b0f8b3d176bf7351c5329c60c163de95e8e643674d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe

Filesize
468KB

MD5
c66c64f3d8641b7110e89aa77d842ece

SHA1
120fd8880472bb0cbee5b1e715aaa6a7d080d009

SHA256
4a5864d5d1c094d10aa4267583c5ee7065820a68bcd086d343500bf9b942c45d

SHA512
ea95a795c7a55b248904e73de940c7a3126c59fb2b2ee9724689a84a2f6054f6e45934aca1cdc4625f0c9b5434073a5bd6ce9a98d0131399c9a91c0c8ae5c7de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25139.exe

Filesize
468KB

MD5
a5b9180551aff56aedc51c33de50d971

SHA1
e55c59822598728a6d71d6b6f7f42aaf95f9b5a6

SHA256
bb05b02fb330b24ebce0c3c10c792909bd9e0bccef8622855ce234197dcadf20

SHA512
124387369a00ae6fb86ef79e7534246f7a4437a1072174199478261d46d0734b648d3883717692521114ee2396ad33cf43d5a45a8b27e7418efd36cd75453d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26595.exe

Filesize
468KB

MD5
b9af13417d0252b1dc207c1f2cdd6ac0

SHA1
0a196636f3c5c4bcc8c3336d499fc67e4fa67cc2

SHA256
525900c9b525d4eb7bd88d39241ca213f50ec50d8dbb3e491a1285327b292e0f

SHA512
35a979094e9e15fbd96c503cc2a0f2fc0900bc493acc689d366e01e46479342b0e1adada15eb01f26657f04905ee68ccb7b715fd6a6cb55240155832e08b443d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29859.exe

Filesize
468KB

MD5
7e72669f46d9836180cb93cefa473b46

SHA1
4b8b48b907bd516322d383045eeee8535e74c1a9

SHA256
0ff5c31b99380dbf93e21a123a27ad8620b284c15776822a6a86f7f64c460e5d

SHA512
b18f4ad3e452136ede77be7a28616129a53c6811088d61c36a37e2f074592272e152559c9677ff4b1e8da12398593978bd8e2259b79ac8c639c9ea4b802835b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35981.exe

Filesize
468KB

MD5
2d782e969070ff3b8a0175bfa9716484

SHA1
9f02861b4f660b32aa89560fc85e3537a77dc37f

SHA256
917d6d14bceb15399565ce918eba2263901f46a2e085e3e0fcd55558b80516b3

SHA512
df955a3a36a639ea4e32c36c132976ec7fbae6abd32a37e72b9c01abe0a7b19bf2ff5639c7af903ce29bfb32c2636efdf9a7b28c3e960e6f54c55370be2dbe42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe

Filesize
468KB

MD5
6810138c30a654dc4e4e64a993264576

SHA1
f5c0323c5feee83a83115e7773d294cb8e6339bb

SHA256
8b11e730e97eb8068aecca070759ea1970ae5c489dbbf2ebf3a2e6c262804bd6

SHA512
3931b746c3436f2a8324ebcf9c1b62704e0adc29defce460f35958bce0554b11c6e445e9d09d6e3e2112097c01619d7cf66116b8b094a823132c6d1df0a031db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe

Filesize
468KB

MD5
32f3f432a803d8ff72b7b160eb26efa1

SHA1
1784a0ef9f69286af3d082ee3eba40b205a4e801

SHA256
0a21582a48a00ab1f4e3dfb01d4f13ffb95d9995d323cab071ef456c37649b2d

SHA512
35ff3dc6aa059e3c554bf89ad023704f90c5ccf55b7e67e6074831a605f3f8c0cd7d2b6b8a8e194ebacbe0481515de01c09be7640c1a8fc811754817e33617b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43203.exe

Filesize
468KB

MD5
ff2f56c9af01497057ff61c75003159e

SHA1
cf73f2f4187605f2a78d704423489af90df17ba5

SHA256
690f9c035bbe8acec04a9629e1baa2d1053f28a6ae78042a57c1c45681ba6fe3

SHA512
b5da622e108ef840fe728fb40ddf5177b22ec51797733bec6a620fbfd31409919cce628521c6fb9e604cee79ebc53efd0a4693dd416c84a72f8728cf38d8c1f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exe

Filesize
468KB

MD5
8ccd7a8bb94b3c2d225f094f7ae6625e

SHA1
906dd1e2810dd14ef195292ecb7d1ba804cf2b53

SHA256
bf02a744b80a4fd24837b8f223612a5e5566ca8469852d7879eff36348b53df9

SHA512
f3b4da3f75db0fb29ad2cf70cc4dfaacaaeb0ec10d3107303af6ab8c784b5fbb6a768a78d83e16bd8b4bc2275bab382306090646d3293a537cb272053f44bf3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe

Filesize
468KB

MD5
f2f494b42ebdb23f0ceee1c75c221cc2

SHA1
55f4309cedcbfefac0b891937080951b910869f2

SHA256
e3017b9902095c0e476a324fbff1edc3d5202f5dfd44a33ee3a412a4a8aeda3d

SHA512
416d84cd292245d29475b32d9e70ac9e6bde890b8468995ed69a4ec97d11beed8f17760c3c4e8fac6d700c34c22c3e8f79c1a7c2aea6acac159e471c3b620570

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46314.exe

Filesize
468KB

MD5
11da7d8c05165a7117bd2e49acee5ed8

SHA1
760f507e166c6071264828d2a297d73b24bdcc88

SHA256
075a84e6c91b02b1c3c5d4fae67be521b6140f3d0b8e12995974446127ee4019

SHA512
dd4c394bac474928bcbf03cc22e5050faf9cf8f9e922165910ab1bf40d1aaa76ffc3bebf04cb6a10ec6d0745b31bc79958b4ff9c565a809baeda0c14c406892b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exe

Filesize
468KB

MD5
9179677bb2ae628b1ea6739495f5cd97

SHA1
515c53249ac96984ea43ba253ff950e8164d97b3

SHA256
caef55576117378d6c5003dc61f9e61881c38f9f93d2c633a9efe4c55185c585

SHA512
baf080853e9e41eb4f1ac46008df11b9402f930bb7a2daed75098dba6b30bf0b75094e2ea226725fd090a607cf751cdb9efaacf32f346d62256b7ad4f7488a55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe

Filesize
468KB

MD5
5efb6d555ff863a01378e2914ed0b054

SHA1
b75460a99ac7003db054b8d16f88bb6925aa9967

SHA256
3d3be96b9e812806a93295b1f8ecf99e9ee6ab8dd1ed7b185833282b49d73289

SHA512
4f99a57b738205603f7ef36af3fb469f7ca998415d5e57f53ddda26eeb979ae1b060af8d240a6dce7cc8e1587fbe36a22358b0a24fd4ed84e5e16531f9b03798

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe

Filesize
468KB

MD5
a284fb2af1c21232b91677db5e1c0f56

SHA1
1e206f3ade3647f67d196e1bbf85a5ccf4d5041b

SHA256
f90fe3b1d4e56f064f295d01d175ff3ce2b069cfc0ae71fc8de6d8b1f9fa2243

SHA512
7a7ddec44eb68e94e1177d5c5551e4689e130463c89a2c305e5e700b3080d7d3c2f09c650fb5248f0a6bbbf49eb66672d1d96ea0c846172f5267b245de42154d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe

Filesize
468KB

MD5
9a6465f59c5e497dcf4743dd82faf633

SHA1
54a45aa4c857a25d59418999fa84925acfa5b5d5

SHA256
ac6b1febaf9860f326c9e389f340f9800744a8c067d8c4c8b321d28b02dd2990

SHA512
5122273b7d5603f3707950765effa034d18aa796e5e85f3c985d4f2d1083c32bb0dd53ce98faea22ece26db271532597eb04f09816d5e1d2c071cafb5c101514

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55337.exe

Filesize
468KB

MD5
4344c1628146232dab36de6c718ab8fb

SHA1
04e23c3f4b5f139b57d0e66eba3b8e39dfa34c46

SHA256
c1901fbf747d9721168999c0549b2fb6cb4610a91706dce1740224402423e556

SHA512
5893c194ef126542e7203d77d61aedb98dd476d838cad6377f1f904354ade340ca4e95c759495143b134ad6105e05cacc37b24a778fb85e918a46048f5899365

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe

Filesize
468KB

MD5
5e28768a93a8e3b7849736ef366c918c

SHA1
ad42b95d68d124473e6be408882d232ec00e1811

SHA256
f5b269abae08f2c416b1a341e2d503900d3b3d3516b94b32d7a35244a34d0f67

SHA512
dd13a50f3cfb4a9b1d5232698c7e9551a70935786a69ea2be0fcd24f3586bda1193d013906167877b61995f532ae8fdc50b6eec43deef763e878977010fa9174

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe

Filesize
468KB

MD5
1611a12c486f9d93332b22bc4e6b67d6

SHA1
0b09876953ac2151e439c58252a5a5e5d0ce0b6b

SHA256
f6e29c8f87b4bcf5d8c139ad1ee97b94416c93e3de0bf8a59be1bb5480fb49ed

SHA512
bd7e6d7d899b78b9a34e84aff76db0f153baddbcee1179bbfa31720780157d543566655e776eb7be23bc9dd51ff654786d47ae52a91706db45898fb9c9032346

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe

Filesize
468KB

MD5
bf06f398bbed919c38d6be6f2ac53654

SHA1
1bd890dd78101c9d9f115965596d24e9e2bc7c85

SHA256
b72ad0ac9bebf65de24f9241e9b83af92bab54825333ef11ae45b4dc0a333247

SHA512
f5fb0d2e69ef02f1ec7e66d7fa3fdf547b928565c366c42e3fb2f34e54361ad7f627aa90ab38e4ecba0b2de56862d2f4c7171087a3a56027abae5ce0cfc47cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe

Filesize
468KB

MD5
814327f1634db13980a906bbca946b23

SHA1
594996264614f971b4516771b40636a3f6e94eba

SHA256
15b64682f00a695ac34f8a2c147e23640048ade314b8084dd1267f7b25069460

SHA512
9e85eb51cacbf0d2e798799ccf850af81c8234eb2b8014e1fd4a349a21ec7cec95e2beb621979974110a7cd6801d688c5ee5b907090508ec3c7250d7a051ac96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60419.exe

Filesize
468KB

MD5
12622ca4f4c479462661f5dbcb5fabee

SHA1
ed5d98fcc0457b320a715d3aee2e9fb93a55b423

SHA256
c6b42f20026df046828cc2b1999d0d17bade06a73829f496e8f5b894c5c1cc62

SHA512
fbbc5205a6bdb3307f503fb287defe07180d9234fb5784ee3e0e3390f36e0797d43281723fba885a749ce5fa557cbfba206837b18004f7376a6e24880ab6b83c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe

Filesize
468KB

MD5
cd4557ef1f59b51188e3b12baeb0191e

SHA1
4478f4a76703ca881f6cf45e2bf03efa4afeee63

SHA256
d22d9f15c25ca36343af217d41dc2f2c316ad8dee479a8e31caf3241c17935ec

SHA512
1f70ba3d21721650f5307fcda3fd8fb9568c414fefcb1ed29d7f66e6f602cddcd14522855bec0cfda999c5c7e30299bc1c8f0d22cb4d71252a88b8ea77983840

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe

Filesize
468KB

MD5
f3d4f850922a3ad3159f9cadd181f8e0

SHA1
663f710e2ad143167c9d12b4ee9ad4ce38f0a266

SHA256
aed1c305b5a28cd005f3b5fc5b2fd8a5ccadaf5cc84bfdf7a6e58af3db6b4ff1

SHA512
c2f0ddbe5abce64a9d6a1bfda181de4543747f58ef2e5eba80fa58e7dafa889ff606845107cdc8eec8dd5ad3ad53e8e4aed373fc1b8de5a674b0ffef1a6a6480

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe

Filesize
468KB

MD5
43e51128aed6771f585e02cb971f3bfe

SHA1
9646a125096222323cc1e03c6a85849d75518ad5

SHA256
a0f13cb164bc8a1c64998d38439b30e80ed9d920910899bdbb54f7ae3a702988

SHA512
93c4daff9e6efc46c8e0d8bb3ca18f4a3412707500d7534f1898f706ec8f8c3dce9f6f5d53e11443fbe53cb2fbc86edee68ef08b7769249cb559a809355c1606

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7341.exe

Filesize
468KB

MD5
e89497ba549b8bc658906afcc1e1e08e

SHA1
1289fc7e81334e622031f19b116c5b95ef605d9f

SHA256
0643940a6b6d7199874c90f274763b2f8f57310243549afe0eb0e6cb3dca9478

SHA512
d4e868940c6321994783efb69a01f24913c4443d743623636e0fdeba179346e703dce91bef41b892d043d7c12989e211133b36c3b80dffb1e188a39419596d46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe

Filesize
468KB

MD5
6f1fc0489970818cba309c0c0cf379c3

SHA1
bd286f1415b1c5188ebbc2498fe004619c18007a

SHA256
35f1817aa4864476c567366ec7f4d9ae503277418328b38ceae08e03f8d2cd45

SHA512
a58b26d52a4902ff979f4b0954eded972bcf26c59b88fd4681419a9d4cc21ed51ab0121bf4cc8735995954bda665c7cdd91a48cb3205f65876618166f6a638ef

Download Submit
memory/624-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/668-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/704-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/764-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/824-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/972-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1008-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1048-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1096-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1100-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1180-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1384-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1484-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1884-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2156-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2272-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-30-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3116-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3152-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3212-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3228-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3256-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3272-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3292-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3296-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3312-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3328-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3392-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3396-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3508-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3632-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3648-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3732-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3776-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3804-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3872-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3900-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4076-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4112-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4212-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4292-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4484-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4608-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4632-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4664-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4780-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4864-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-564-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5308-597-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5316-595-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-596-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-598-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads