68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197

Analysis

max time kernel
119s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe
Size

468KB
MD5

8b23578a8ca73899aca3d6545c93d080
SHA1

c8813c9e28256240621193b11d7f09746b3ca95d
SHA256

68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197
SHA512

84aac84e344d75949f2e341cee861f6dc2a4a022cffd139ac052a28473fa4b40372d274c346e2b53eb76a9950278b17f71c5b94e71fe18b9db3dc37b6bc9d462
SSDEEP

3072:1bA4onIdIN5jtbYGPOtjcc8/42C4P3p5ymHeFVqhReb84cQ6XGmlW:1bLoRLjt5POjcc8ZiuReItpXG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4060	Unicorn-33437.exe
2004	Unicorn-40941.exe
1524	Unicorn-62108.exe
324	Unicorn-17309.exe
628	Unicorn-15891.exe
4972	Unicorn-35757.exe
3444	Unicorn-45963.exe
4968	Unicorn-43645.exe
3108	Unicorn-56644.exe
4084	Unicorn-18949.exe
1612	Unicorn-18949.exe
4276	Unicorn-18949.exe
3300	Unicorn-12818.exe
5060	Unicorn-10515.exe
3260	Unicorn-56452.exe
2392	Unicorn-21933.exe
2344	Unicorn-13572.exe
3796	Unicorn-26955.exe
4852	Unicorn-57219.exe
1428	Unicorn-45477.exe
4272	Unicorn-29717.exe
2124	Unicorn-21283.exe
1820	Unicorn-21549.exe
624	Unicorn-53837.exe
2180	Unicorn-18019.exe
4856	Unicorn-59052.exe
3176	Unicorn-59052.exe
928	Unicorn-7250.exe
3580	Unicorn-37885.exe
1636	Unicorn-28954.exe
3696	Unicorn-55093.exe
4404	Unicorn-43395.exe
4104	Unicorn-37989.exe
4768	Unicorn-58964.exe
4824	Unicorn-13292.exe
3140	Unicorn-46157.exe
4236	Unicorn-21579.exe
1388	Unicorn-23882.exe
4440	Unicorn-5508.exe
1604	Unicorn-4475.exe
5088	Unicorn-32317.exe
1124	Unicorn-23386.exe
2044	Unicorn-49997.exe
3752	Unicorn-58741.exe
3312	Unicorn-50573.exe
1736	Unicorn-9540.exe
4476	Unicorn-42021.exe
4760	Unicorn-46852.exe
4952	Unicorn-21195.exe
1976	Unicorn-34930.exe
1572	Unicorn-16365.exe
1968	Unicorn-56436.exe
1608	Unicorn-40869.exe
4008	Unicorn-49229.exe
2472	Unicorn-57708.exe
2436	Unicorn-51843.exe
4328	Unicorn-43675.exe
1172	Unicorn-29939.exe
4224	Unicorn-29939.exe
1944	Unicorn-18477.exe
3536	Unicorn-16085.exe
3156	Unicorn-7916.exe
1392	Unicorn-29659.exe
1164	Unicorn-49525.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
15492	7888	WerFault.exe	323
2700	14588	WerFault.exe	699

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33506.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15552	dwm.exe
Token: SeChangeNotifyPrivilege	15552	dwm.exe
Token: 33	15552	dwm.exe
Token: SeIncBasePriorityPrivilege	15552	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe
4060	Unicorn-33437.exe
2004	Unicorn-40941.exe
1524	Unicorn-62108.exe
4972	Unicorn-35757.exe
324	Unicorn-17309.exe
628	Unicorn-15891.exe
3444	Unicorn-45963.exe
4968	Unicorn-43645.exe
3108	Unicorn-56644.exe
5060	Unicorn-10515.exe
3260	Unicorn-56452.exe
4084	Unicorn-18949.exe
3300	Unicorn-12818.exe
4276	Unicorn-18949.exe
1612	Unicorn-18949.exe
2392	Unicorn-21933.exe
2344	Unicorn-13572.exe
3796	Unicorn-26955.exe
4852	Unicorn-57219.exe
1428	Unicorn-45477.exe
4272	Unicorn-29717.exe
2124	Unicorn-21283.exe
2180	Unicorn-18019.exe
3580	Unicorn-37885.exe
4856	Unicorn-59052.exe
1636	Unicorn-28954.exe
624	Unicorn-53837.exe
1820	Unicorn-21549.exe
3176	Unicorn-59052.exe
928	Unicorn-7250.exe
3696	Unicorn-55093.exe
4404	Unicorn-43395.exe
4104	Unicorn-37989.exe
3140	Unicorn-46157.exe
4824	Unicorn-13292.exe
4768	Unicorn-58964.exe
4236	Unicorn-21579.exe
1388	Unicorn-23882.exe
4440	Unicorn-5508.exe
1604	Unicorn-4475.exe
1124	Unicorn-23386.exe
5088	Unicorn-32317.exe
2044	Unicorn-49997.exe
3752	Unicorn-58741.exe
3312	Unicorn-50573.exe
1736	Unicorn-9540.exe
4476	Unicorn-42021.exe
4760	Unicorn-46852.exe
1968	Unicorn-56436.exe
4952	Unicorn-21195.exe
2436	Unicorn-51843.exe
1172	Unicorn-29939.exe
4224	Unicorn-29939.exe
2472	Unicorn-57708.exe
1572	Unicorn-16365.exe
1976	Unicorn-34930.exe
4008	Unicorn-49229.exe
1608	Unicorn-40869.exe
4328	Unicorn-43675.exe
1944	Unicorn-18477.exe
3156	Unicorn-7916.exe
1392	Unicorn-29659.exe
3536	Unicorn-16085.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 4060	3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe	82
PID 3588 wrote to memory of 4060	3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe	82
PID 3588 wrote to memory of 4060	3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe	82
PID 4060 wrote to memory of 2004	4060	Unicorn-33437.exe	83
PID 4060 wrote to memory of 2004	4060	Unicorn-33437.exe	83
PID 4060 wrote to memory of 2004	4060	Unicorn-33437.exe	83
PID 3588 wrote to memory of 1524	3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe	84
PID 3588 wrote to memory of 1524	3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe	84
PID 3588 wrote to memory of 1524	3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe	84
PID 2004 wrote to memory of 324	2004	Unicorn-40941.exe	89
PID 2004 wrote to memory of 324	2004	Unicorn-40941.exe	89
PID 2004 wrote to memory of 324	2004	Unicorn-40941.exe	89
PID 4060 wrote to memory of 628	4060	Unicorn-33437.exe	90
PID 4060 wrote to memory of 628	4060	Unicorn-33437.exe	90
PID 4060 wrote to memory of 628	4060	Unicorn-33437.exe	90
PID 1524 wrote to memory of 4972	1524	Unicorn-62108.exe	91
PID 1524 wrote to memory of 4972	1524	Unicorn-62108.exe	91
PID 1524 wrote to memory of 4972	1524	Unicorn-62108.exe	91
PID 3588 wrote to memory of 3444	3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe	92
PID 3588 wrote to memory of 3444	3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe	92
PID 3588 wrote to memory of 3444	3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe	92
PID 4972 wrote to memory of 4968	4972	Unicorn-35757.exe	94
PID 4972 wrote to memory of 4968	4972	Unicorn-35757.exe	94
PID 4972 wrote to memory of 4968	4972	Unicorn-35757.exe	94
PID 1524 wrote to memory of 3108	1524	Unicorn-62108.exe	95
PID 1524 wrote to memory of 3108	1524	Unicorn-62108.exe	95
PID 1524 wrote to memory of 3108	1524	Unicorn-62108.exe	95
PID 628 wrote to memory of 4084	628	Unicorn-15891.exe	97
PID 628 wrote to memory of 4084	628	Unicorn-15891.exe	97
PID 628 wrote to memory of 4084	628	Unicorn-15891.exe	97
PID 324 wrote to memory of 1612	324	Unicorn-17309.exe	96
PID 324 wrote to memory of 1612	324	Unicorn-17309.exe	96
PID 324 wrote to memory of 1612	324	Unicorn-17309.exe	96
PID 3444 wrote to memory of 4276	3444	Unicorn-45963.exe	99
PID 3444 wrote to memory of 4276	3444	Unicorn-45963.exe	99
PID 3444 wrote to memory of 4276	3444	Unicorn-45963.exe	99
PID 4060 wrote to memory of 3300	4060	Unicorn-33437.exe	98
PID 4060 wrote to memory of 3300	4060	Unicorn-33437.exe	98
PID 4060 wrote to memory of 3300	4060	Unicorn-33437.exe	98
PID 3588 wrote to memory of 5060	3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe	100
PID 3588 wrote to memory of 5060	3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe	100
PID 3588 wrote to memory of 5060	3588	68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe	100
PID 2004 wrote to memory of 3260	2004	Unicorn-40941.exe	101
PID 2004 wrote to memory of 3260	2004	Unicorn-40941.exe	101
PID 2004 wrote to memory of 3260	2004	Unicorn-40941.exe	101
PID 4968 wrote to memory of 2392	4968	Unicorn-43645.exe	104
PID 4968 wrote to memory of 2392	4968	Unicorn-43645.exe	104
PID 4968 wrote to memory of 2392	4968	Unicorn-43645.exe	104
PID 3108 wrote to memory of 2344	3108	Unicorn-56644.exe	105
PID 3108 wrote to memory of 2344	3108	Unicorn-56644.exe	105
PID 3108 wrote to memory of 2344	3108	Unicorn-56644.exe	105
PID 4972 wrote to memory of 3796	4972	Unicorn-35757.exe	106
PID 4972 wrote to memory of 3796	4972	Unicorn-35757.exe	106
PID 4972 wrote to memory of 3796	4972	Unicorn-35757.exe	106
PID 1524 wrote to memory of 4852	1524	Unicorn-62108.exe	107
PID 1524 wrote to memory of 4852	1524	Unicorn-62108.exe	107
PID 1524 wrote to memory of 4852	1524	Unicorn-62108.exe	107
PID 3300 wrote to memory of 1428	3300	Unicorn-12818.exe	108
PID 3300 wrote to memory of 1428	3300	Unicorn-12818.exe	108
PID 3300 wrote to memory of 1428	3300	Unicorn-12818.exe	108
PID 4084 wrote to memory of 624	4084	Unicorn-18949.exe	109
PID 4084 wrote to memory of 624	4084	Unicorn-18949.exe	109
PID 4084 wrote to memory of 624	4084	Unicorn-18949.exe	109
PID 3260 wrote to memory of 4272	3260	Unicorn-56452.exe	110

C:\Users\Admin\AppData\Local\Temp\68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe
"C:\Users\Admin\AppData\Local\Temp\68836042a7f3c34c0e65bc77c1a32190b93acb3f38a28268c3efb1d5b32dc197N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58741.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44045.exe
        8⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        9⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        10⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40467.exe
        10⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        10⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
        9⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        9⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3305.exe
        9⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        9⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        9⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17482.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        8⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        8⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24371.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18133.exe
        9⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
        9⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        9⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25886.exe
        9⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        8⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        8⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41675.exe
        7⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        8⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        8⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63931.exe
        8⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
        8⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62652.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
        7⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27019.exe
        7⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        7⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53749.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14780.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53356.exe
        9⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57171.exe
        8⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        8⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
        8⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
        8⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44365.exe
        8⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        8⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
        8⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23050.exe
        7⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
        7⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        7⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40467.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52464.exe
        7⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7389.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59052.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23027.exe
        6⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        8⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        7⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4234.exe
        7⤵
        
        PID:14284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        7⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
        6⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5652.exe
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43651.exe
        7⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46267.exe
        7⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        7⤵
        
        PID:16380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57268.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        6⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51843.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        7⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31626.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50090.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61011.exe
        7⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        6⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62812.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        6⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        6⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43027.exe
        5⤵
        
        PID:8336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20451.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        5⤵
        
        PID:15948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44946.exe
        5⤵
        
        PID:15692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        5⤵
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56452.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19349.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21555.exe
        9⤵
        
        PID:14588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14588 -s 496
        10⤵
        Program crash
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53060.exe
        9⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        9⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13450.exe
        8⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        8⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        8⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19771.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41781.exe
        8⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20471.exe
        8⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        7⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
        7⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60467.exe
        7⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        7⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        7⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
        7⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58501.exe
        8⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        8⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        8⤵
        
        PID:17292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4818.exe
        7⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        7⤵
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65515.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        7⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53460.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        7⤵
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3082.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        6⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
        6⤵
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31893.exe
        6⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60493.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44765.exe
        9⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        9⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        8⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
        8⤵
        
        PID:17504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62187.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        7⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20155.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38141.exe
        7⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        7⤵
        
        PID:16204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41219.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52780.exe
        6⤵
        
        PID:13280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:14624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51780.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe
        7⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
        7⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        7⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17482.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48116.exe
        5⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11988.exe
        6⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        6⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
        5⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        5⤵
        
        PID:13064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44085.exe
        5⤵
        
        PID:15680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        5⤵
        
        PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40869.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe
        7⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        7⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        7⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46019.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
        6⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        6⤵
        
        PID:16184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        5⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13067.exe
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        5⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        5⤵
        
        PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57708.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52045.exe
        6⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7100.exe
        7⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        7⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        7⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        6⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        6⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        5⤵
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47275.exe
        5⤵
        
        PID:13040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        5⤵
        
        PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
      4⤵
      PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14956.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        5⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63844.exe
        5⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        5⤵
        
        PID:15432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exe
      4⤵
      PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
      4⤵
      PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
      4⤵
      PID:6316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44045.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        9⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        10⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        10⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28459.exe
        9⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        9⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        9⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        8⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
        8⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        8⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9875.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        8⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42422.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4234.exe
        7⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        7⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        8⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53356.exe
        8⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24330.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        7⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe
        7⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
        7⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        7⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        7⤵
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        6⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        7⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        7⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47275.exe
        6⤵
        
        PID:12812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
        6⤵
        
        PID:15648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        6⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16298.exe
        5⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34661.exe
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45733.exe
        7⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
        7⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60372.exe
        6⤵
        
        PID:13596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        5⤵
        
        PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
        6⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        8⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62483.exe
        8⤵
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
        8⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        7⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        7⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13628.exe
        7⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
        7⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        7⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48235.exe
        6⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14139.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        6⤵
        
        PID:15976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13707.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46741.exe
        6⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9531.exe
        7⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35398.exe
        7⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24883.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        6⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29147.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
        6⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38148.exe
        5⤵
        
        PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        5⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63373.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53965.exe
        7⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
        7⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37403.exe
        7⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        7⤵
        
        PID:14400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26419.exe
        6⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        7⤵
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1426.exe
        6⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52636.exe
        5⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        6⤵
        
        PID:14076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        6⤵
        
        PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7394.exe
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        5⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        5⤵
        
        PID:16168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
      4⤵
      PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        5⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        5⤵
        
        PID:14880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
      4⤵
      PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30225.exe
        5⤵
        
        PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
      4⤵
      PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
      4⤵
      PID:15184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
      4⤵
      PID:7596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45477.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5508.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        6⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        7⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59357.exe
        8⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
        8⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
        8⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        8⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-379.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        7⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19387.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46109.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        7⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe
        7⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-762.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5923.exe
        5⤵
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37037.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe
        7⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        7⤵
        
        PID:17400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe
        6⤵
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        6⤵
        
        PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        5⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        6⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37285.exe
        7⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        7⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        6⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19062.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28916.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59387.exe
        5⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        5⤵
        
        PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4475.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56349.exe
        5⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52029.exe
        6⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9964.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49020.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        7⤵
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        6⤵
        
        PID:13296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        6⤵
        
        PID:464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
        6⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45827.exe
        5⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        5⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        5⤵
        
        PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
      4⤵
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        5⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        6⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39299.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        5⤵
        
        PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        5⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        5⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        5⤵
        
        PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
      4⤵
      PID:13324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
      4⤵
      PID:16008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
      4⤵
      PID:1644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32317.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50677.exe
        5⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64291.exe
        7⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        7⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14219.exe
        6⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
        6⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        6⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe
        5⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        6⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        6⤵
        
        PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58219.exe
        5⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29132.exe
        5⤵
        
        PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe
        5⤵
        
        PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13788.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        6⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        6⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10275.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34540.exe
        5⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        5⤵
        
        PID:17196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
      4⤵
      PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59708.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38419.exe
      4⤵
      PID:9988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
      4⤵
      PID:12316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
      4⤵
      PID:16016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
      4⤵
      PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
      4⤵
      PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38589.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26843.exe
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
        5⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        5⤵
        
        PID:17568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
      4⤵
      PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58501.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        5⤵
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe
      4⤵
      PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
      4⤵
      PID:13736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
      4⤵
      PID:17360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
    3⤵
    PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
      4⤵
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24205.exe
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        5⤵
        
        PID:17368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43627.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63827.exe
      4⤵
      PID:13456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
      4⤵
      PID:7904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10484.exe
    3⤵
    PID:7040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
    3⤵
    PID:9452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
    3⤵
    PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
    3⤵
    PID:5668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55093.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        9⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44965.exe
        10⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        10⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe
        9⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        9⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        9⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23051.exe
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22589.exe
        9⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21465.exe
        9⤵
        
        PID:17756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        8⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8099.exe
        8⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        8⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        8⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15741.exe
        8⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
        8⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
        7⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        7⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29659.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
        8⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48709.exe
        9⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        9⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        9⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        8⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        8⤵
        
        PID:17512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27851.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
        8⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        8⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24794.exe
        7⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30580.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28090.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        7⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        7⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54380.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
        6⤵
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56468.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31085.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
        8⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27483.exe
        7⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        7⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
        6⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        7⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23647.exe
        7⤵
        
        PID:17528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46036.exe
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21914.exe
        6⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59731.exe
        5⤵
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        6⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26493.exe
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31531.exe
        7⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-851.exe
        6⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        7⤵
        
        PID:15448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe
        6⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        6⤵
        
        PID:13920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
        5⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
        6⤵
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        6⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        5⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26123.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2062.exe
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26955.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16085.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25797.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19595.exe
        8⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31626.exe
        8⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
        8⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31410.exe
        7⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        7⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44364.exe
        6⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        7⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        6⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        7⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51132.exe
        6⤵
        
        PID:11988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        6⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53012.exe
        5⤵
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6636.exe
        8⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        8⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        8⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23067.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        7⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
        7⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41307.exe
        6⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34908.exe
        6⤵
        
        PID:14496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35194.exe
        6⤵
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58117.exe
        6⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        6⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        6⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62068.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        5⤵
        
        PID:13648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
        5⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
        6⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        8⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        8⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        7⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36251.exe
        7⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        7⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62755.exe
        6⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36434.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        6⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        6⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe
        6⤵
        
        PID:14248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        6⤵
        
        PID:16148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        6⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        5⤵
        
        PID:13044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        5⤵
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
      4⤵
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
        5⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        6⤵
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        5⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63813.exe
        6⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        5⤵
        
        PID:11128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34908.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        5⤵
        
        PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
        5⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61995.exe
        5⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        5⤵
        
        PID:15528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26491.exe
      4⤵
      PID:8316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37517.exe
      4⤵
      PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60391.exe
      4⤵
      PID:15672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9460.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        8⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
        9⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4347.exe
        9⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        9⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
        9⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        8⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        8⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        8⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14883.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        8⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        8⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        8⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        7⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8099.exe
        7⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        7⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12356.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        7⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        7⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46787.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53012.exe
        5⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exe
        6⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22269.exe
        7⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2131.exe
        7⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        7⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52564.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7483.exe
        5⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        5⤵
        
        PID:10928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
        5⤵
        
        PID:14688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        5⤵
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20753.exe
        5⤵
        
        PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58964.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        5⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43477.exe
        6⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe
        7⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58220.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11634.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        6⤵
        
        PID:228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40091.exe
        6⤵
        
        PID:14256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        6⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe
        5⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        5⤵
        
        PID:14484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
      4⤵
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52029.exe
        5⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-187.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11835.exe
        5⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
      4⤵
      PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        5⤵
        
        PID:14220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
      4⤵
      PID:8684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52172.exe
      4⤵
      PID:12036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
      4⤵
      PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13292.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49525.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10820.exe
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
        7⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18570.exe
        7⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
        6⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        6⤵
        
        PID:16324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22403.exe
        6⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
        6⤵
        
        PID:14488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        6⤵
        
        PID:17456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        5⤵
        
        PID:12732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26443.exe
        5⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23533.exe
        5⤵
        
        PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
      4⤵
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        5⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65356.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18098.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:14868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51899.exe
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35292.exe
        5⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3762.exe
        5⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
        5⤵
        
        PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32250.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1132.exe
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe
        5⤵
        
        PID:12672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        5⤵
        
        PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
      4⤵
      PID:8344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36986.exe
      4⤵
      PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
      4⤵
      PID:15600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
      4⤵
      PID:832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56349.exe
      4⤵
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12164.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40467.exe
        6⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        5⤵
        
        PID:12864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        5⤵
        
        PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
      4⤵
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18133.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        5⤵
        
        PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48515.exe
      4⤵
      PID:8632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18650.exe
      4⤵
      PID:13672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
      4⤵
      PID:16260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
    3⤵
    PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
      4⤵
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12356.exe
        5⤵
        
        PID:7888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7888 -s 540
        6⤵
        Program crash
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        5⤵
        
        PID:11348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12427.exe
        5⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3584.exe
        5⤵
        
        PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31130.exe
      4⤵
      PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
      4⤵
      PID:13080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
      4⤵
      PID:14996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6387.exe
    3⤵
    PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17469.exe
      4⤵
      PID:10588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
      4⤵
      PID:316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
    3⤵
    PID:9996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
    3⤵
    PID:12328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8859.exe
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21549.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe
        8⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        8⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        8⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
        7⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        7⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        7⤵
        
        PID:17464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23435.exe
        6⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe
        6⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33177.exe
        6⤵
        
        PID:14564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18515.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23266.exe
        6⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54337.exe
        6⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        6⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
        5⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27019.exe
        5⤵
        
        PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
        5⤵
        
        PID:16372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4164.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13788.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51189.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
        7⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        7⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10275.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34054.exe
        6⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19107.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24397.exe
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38275.exe
        6⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19147.exe
        5⤵
        
        PID:13604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        5⤵
        
        PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37347.exe
      4⤵
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-924.exe
        5⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
        6⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        5⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12283.exe
      4⤵
      PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        5⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        5⤵
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24123.exe
      4⤵
      PID:14376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
      4⤵
      PID:15500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59052.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34661.exe
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
        5⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        6⤵
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        6⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42387.exe
        5⤵
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
        5⤵
        
        PID:15260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        5⤵
        
        PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
      4⤵
      PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3908.exe
        5⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24625.exe
        5⤵
        
        PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
      4⤵
      PID:9416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
      4⤵
      PID:12348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
      4⤵
      PID:16020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25605.exe
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4892.exe
        6⤵
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        6⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36251.exe
        5⤵
        
        PID:14980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
        5⤵
        
        PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46019.exe
      4⤵
      PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
      4⤵
      PID:12280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
      4⤵
      PID:16144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46467.exe
    3⤵
    PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24205.exe
      4⤵
      PID:10712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29531.exe
      4⤵
      PID:15232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50782.exe
      4⤵
      PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe
    3⤵
    PID:8352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64141.exe
    3⤵
    PID:12988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14386.exe
    3⤵
    PID:15744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
    3⤵
    PID:4256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9540.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44045.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36005.exe
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53232.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33051.exe
        5⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        6⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45256.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20347.exe
      4⤵
      PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43341.exe
        5⤵
        
        PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29825.exe
        5⤵
        
        PID:17872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56787.exe
      4⤵
      PID:9240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55940.exe
      4⤵
      PID:12832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
      4⤵
      PID:15636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7267.exe
    3⤵
    PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38765.exe
      4⤵
      PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43021.exe
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        5⤵
        
        PID:11396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4259.exe
        5⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        5⤵
        
        PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34779.exe
      4⤵
      PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4818.exe
      4⤵
      PID:12488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
      4⤵
      PID:14864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
      4⤵
      PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
      4⤵
      PID:14052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
      4⤵
      PID:16212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5082.exe
    3⤵
    PID:9912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
    3⤵
    PID:7508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56436.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56436.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51253.exe
    3⤵
    PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19461.exe
      4⤵
      PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26493.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exe
        5⤵
        
        PID:11644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        5⤵
        
        PID:16180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40067.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21731.exe
      4⤵
      PID:12508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35962.exe
      4⤵
      PID:15784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58692.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53389.exe
      4⤵
      PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
      4⤵
      PID:11312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
      4⤵
      PID:5104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
    3⤵
    PID:9000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
    3⤵
    PID:12432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
    3⤵
    PID:16172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
  2⤵
  PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
      4⤵
      PID:14432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
      4⤵
      PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
    3⤵
    PID:9844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
    3⤵
    PID:13472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3762.exe
    3⤵
    PID:16176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29397.exe
    3⤵
    PID:1116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17786.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17786.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16037.exe
    3⤵
    PID:11208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe
    3⤵
    PID:14916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50398.exe
    3⤵
    PID:14572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61196.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61196.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65316.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65316.exe
  2⤵
  PID:13488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
  2⤵
  PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 14588 -ip 14588
1⤵
PID:15552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 14560 -ip 14560
1⤵
PID:15580

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe

Filesize
468KB

MD5
b1f38b0e62c2fa034e1a478070598d04

SHA1
1fb8a9b01419aca0a93df8678235ce4d0421398f

SHA256
3eb4d308f088a460f66be2d28f7b944cb78ef218fcfc061b97a92e077d8a4b2a

SHA512
b7da57c08111c7dceb783da2487cfc33351df3e3a116587c568fbc64f1aaf811390dca83eb3baf284ed2424a816d3112bf56bc45e3cfb5dadbb4d52c338ff040

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe

Filesize
468KB

MD5
01270697a11eb8942b3bc77d23aeb8ba

SHA1
1bbea0b319f5e037b6280a58de4e08502fc388cc

SHA256
b2906174fa7a489464cb3994d1c77d379a4d861d4cb8fbb3fec8f4da53dd5d3c

SHA512
c571e6c45a71bfd4bfcf5683a08bd15175841c75b0e8f186dcf0e61f12200dbd81aea281727181a47e957f4232180becc6b79e314b7d92f79749b83f857f4ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe

Filesize
468KB

MD5
7504f1416ea5bef6871a86c1ef21e8f8

SHA1
7fdab77b0f5aebc57e3be5e9868d0620b6239631

SHA256
67e159f4869aa3c142a30afdca196af70b4056b20c2638dae63090f1aa1c91a3

SHA512
ce8be2d6633ea8fc01b85ca1e795a4d4e89a58896c7793efe927ca419ef25bd4bf522446f2a215339af1b8f9b22f2f1b77ad6988929887b517041aff3548c946

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe

Filesize
468KB

MD5
7c3858b369004207d7cdd4be2c8a9445

SHA1
36182742d508eb9790cdc9729c7cbca2a05e4514

SHA256
5caf7bbba720ade4fd85d793df14e4661a2e6d601147185fd47fb589d9462ccb

SHA512
75e5b1c1bb31c0bbc1f18f39ea16e2d42620219e22c4bac775e9ccd37aac88cc9ca520e7c737ef9758972ae87d25d9e3d9c60ae2e20771d8df54ffa4abf7e1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17309.exe

Filesize
468KB

MD5
74117e13d544b0840e66676b9ed544fd

SHA1
a9a27304c8de34e425314c440449c3160bb04fd8

SHA256
513e1d18b09a37b380c0add6b8e468b4a576f1b01e5c0451bbc2ec5b224cf3bb

SHA512
18d4256c5bcb8bfcc77e42031030ff47e405b0703fdb4247bf2b69be73f9fe7ebb2d76e7f6885bb5587510db3105b8f9eaf7d7164e81638ec127451c106c186f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe

Filesize
468KB

MD5
ee2f17b03e0b370cd498710709ed181f

SHA1
81e97552627e84a0e24c450bf6b57fbff227d8f9

SHA256
4d56c354d61d4f5499b071e5257d51735470816322deac46d77e11260b2c470e

SHA512
b58a90ebfff7293f122ad9ea02d92f38837cf4f1cae0865295d7cdba19536061d844ea9d1130b53431fbcaa6c1d7f3303ffe624c122dfa4097c1eef3f9af02fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe

Filesize
468KB

MD5
26d34a5ec34d32744e449e61a992c706

SHA1
babde5e2f7e308a968f27fd8cb991d6b3ce0a646

SHA256
401d095065f98d2bf087d107510b58083b33a0ef2ef45b55bbfbe3a25b696d78

SHA512
764805ed404ea6fd62ac59d07a11b6847dd1b4e6f6fb0f975e2a7ef8bb7e4d59c86aae791028a8994e99cc0998aa7ab6edb20225af5df7ae52c98bdd918adcb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21283.exe

Filesize
468KB

MD5
2a58eb85a1a9879cb99b9bb32bb665c6

SHA1
1d4634cd35ba584ce9435f6dc4d1e118bc7510a1

SHA256
878529ff67f0da5432d791a0dffc90673be778a5b839db492f589a0cc882efe1

SHA512
126a54b0a6b876d9cb6e27e1c86a286733cf0a82b0a9626f486be425639f000881cd70cf7d3651345a542bbddc39930ceffb9567deea063b7cda8f275871803d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21549.exe

Filesize
468KB

MD5
18ba5b042f9a37a67acac912112bcdfb

SHA1
f5714fab0a7d11a32e64b4c55bb1fa5ef80b054f

SHA256
8c7883b7237b3d493072b343191ec76fae25de0a17aa5903afaca2612f020c82

SHA512
5e6a3c51a715ce4c2da4ccdb181613eb9277ceb216c23352c9a2accc60f25fe97b09f1b256f5ad7e49aeaf57cafe3bd38d8b9406f7f8d4dced635ceccc95a895

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe

Filesize
468KB

MD5
f4c4b97d435c35f4c5c8c810eabbca1d

SHA1
fe17b41fe8f014e38494b9a5eb252a08fc5ac789

SHA256
47df24b866ed995bf6cf4d86fb80ad9de7b636a0468bce5b292dfbe2df3c67e3

SHA512
77d3043c84560eadf3f26106267b84066cf51941bfffdebaaad9f0c4173954de977f0b23fb0e0d6ea56287b07e4e5b51ea0fe46a534d15df842f8935a0228e1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26955.exe

Filesize
468KB

MD5
183fe8e05829d6e5dee2b07dc8be2afe

SHA1
006287d7cc770b48cc5e34ac1c86a5e9b26dc607

SHA256
25afd0840b07575caa8b4aaedb2a0a6f1905a11b682a606830a61c5bcb5c4777

SHA512
4e3fe27ba060880973f91374811b89a6f9669cb7f9a55ce40fb39b6ac8f71d4b906efba6294dde075d2519e966ebf4b4642af972a81a90f2d48675a8408113fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe

Filesize
468KB

MD5
08e74584e308740d47961f77ab0fbac2

SHA1
3b96140bbd07fcabd07a447d1b65f26959b1d336

SHA256
6c8ea842549cb2cf123e73c4df6485eed928419e1146b5a0960dd97798a004e4

SHA512
de3160eef5d94af58d87cdf2ff14e99d6eadf4ebd077c87c3a4e24ace6375b37a0537033a004914e208155a7044cd91a13e89846b077c0389940ef0bd20564db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe

Filesize
468KB

MD5
3fe3786a4796bf2494a037b80d47e564

SHA1
fb3ea74c769b9dc24681e257d835002434b0b3e8

SHA256
66286d552229d2848eded253f5e4a169358ae8474ac71acfded11446c06bf108

SHA512
4947da2bdc85327d9c96ba21117017700907e2b1cdd577a8ab3345c949791b65ecc833c3f8126614b02f8fa78480afdc2c42311dd7bde41b8b2c26a418dad408

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe

Filesize
468KB

MD5
35e11fd5238b166d1cbfde8628df0c21

SHA1
b3ff5406d0e5fdea0b04b6ce61e8c96100f77ea1

SHA256
be11cf52b2c74120ae68c57fcea9c105628b31ca024ad9ccd71439140757c2b9

SHA512
6afe86aa19422f51b5ab3bf80d8d8a816b2d0fda5d73e1b254182d17e72d78b0af74d1be0d2bb86bd930de367479228da5478d764cea24d4eafe21a58f85dfc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exe

Filesize
468KB

MD5
e5b277d08a92d4c0c727badcbc616c81

SHA1
85a49cc7b37139311f65046c54832756bc8c7e8e

SHA256
ed88afc3c400e6156e6d37716463e8860601d4445c3115564a26bb1c7ac993c7

SHA512
5d59f027bdb786daa415ac932ce9696086f07e2977d67cd90e9acad7eac6023fb3d0b409ac2d8d0a19022f4a68336c470a040b93d3f872cb33d20c93774fb365

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37885.exe

Filesize
468KB

MD5
8ca0c3faa6d83138e56b710193a4ea03

SHA1
16cb8d6729acdad169c4aefd27bcde245d47db53

SHA256
9ebce580eb268bbc21f7d9870fbaf15b257fc4a4c6ba7c1483dccc1aaa79d64a

SHA512
764cdda7981e86854bf62e5ce44e20048dca890dbf63f9b66ff1f14baeb4defbb557ce7e6777265970a05171db5a76bbaf035398a320f3e3fab69ae4c482df42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe

Filesize
468KB

MD5
c9e7d032482d6c8e0d3180afdfba8ea2

SHA1
57345fc3efbbe82936127510a5bf5830748d29cc

SHA256
34b08fa306260f1446a8feff532f8a692bdd0cab23d00a1586b2fdd36f3b1539

SHA512
32daa67702005152ae9b49d0130cd2bfae0ba9131e5a5dd8182ebefd12112f06babbc685f92c2aa37e40928e5cdd4d3f6d13ac5e7b6a46ccdfce6160f173c898

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe

Filesize
468KB

MD5
a5789fe129ae757b29b68a10c2a45f28

SHA1
64a7f97668d22996398797d0208f33a93149abc1

SHA256
3cbfa670304a3bbb9cc198b95491b8d85227f87197513971af0e4b709ea0e090

SHA512
f0576718f998a78e8216c7e277814a1ac321738b8685b2bd9c3a5ff50d70d8ae6695d3df957e185c64f21c9e352ff00102584e6d2cbac44f79484ddbc1289668

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe

Filesize
468KB

MD5
c1d32a05d30836d3d236762b143c9582

SHA1
0c0e91278e9d84cf5fa49d0b151de59ba945e263

SHA256
f952e980d4ca8527440b3d957784dc5a9fe41fd0505459297f2c23673202325a

SHA512
9ffa50c582e6035ca46b80a023df7c10cbea2d40eb3df15dc92d9106f80c4b58a982d3d50438941dd1031cecd79f7967ef8a0b1bebdc3abc2aa0b8592b4e3405

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe

Filesize
468KB

MD5
28d6e389feb79c82546b3813b4174a4e

SHA1
c07ce2545893c3b7faedcb6754c380489f44b278

SHA256
aaaf7ba67ea08b3226c30c549c9bcb1ee23ec1d69272d777c767254e939edd4a

SHA512
5220c0ed4e1053295e36fcf3d0a136817e5cf9df769e982e9669ffc1452887ff9ed6a0414aa5ef17efb16d1ca4e89f18803002e2e0cdf900092cb3349d97fd5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45477.exe

Filesize
468KB

MD5
1cc1ef42de2ad56dc946e0a846a5de2e

SHA1
fa4fe7216b0ab6f3cc0a1e3a19ce1844f3803daf

SHA256
5422bc5039b327afa413b0cc830616fc071bdfcb69f30c360e7825f5b23a2e20

SHA512
862e25fc9f100d7f46bf36730c143cda8f7f49e119f41070635b8b297c175563ab44ab9a93fd2e2bd2f2747ba0ee0bcfd98d9b97c06ee04f47e1d228c7aa57fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe

Filesize
468KB

MD5
fb68ccc28a019c07b2d49b30a3bea361

SHA1
2e2e0f4fb3f00c9dc566dfcaec64a092f3cc05ae

SHA256
99b1ab19ce0495879019097170ec1d5f19cf667289db736e19d302c6689c6839

SHA512
b7e8a48710bf7d6bffff54b703769491e03422232a22431a558c5621338faade8319781f08d09dd90307ce46f688eac5f6c95a648d409a5882f498cc4f8c6e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe

Filesize
468KB

MD5
9d2de1650b317da883010b504f9e8a3c

SHA1
495982f02d881de987fee21b8ff2fe1016af409a

SHA256
0c14be619d1975828bb044b6d7bb2f60522703931f7dd3e4c5056f147b7159d7

SHA512
736e6a0eca04fd58c2327ec5574658d75d5073f33e1256f6d409ce028b7263524528ba0dc89c2b2165fdb641f25c3b80d17cbf990c5c6a0314b531cd2b00055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe

Filesize
468KB

MD5
e503e94fd963c1105afa681d7a600713

SHA1
1ce12fe2d7e5ce51711dae7e7c10fc79a9e27e18

SHA256
f10cc8a4ef6d7fae2ae6f0d5a7d3adab641dd6185a1642307f1613c9d68449ad

SHA512
dc9d79e49ebd204d51e3bdb151d5113a7a300f2d218d5cc0f38779fe303688f58acd8bc8d978c3f9ecaa0eeaca5b6476d877ce7a2fc58ecb82948e4d41059d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55093.exe

Filesize
468KB

MD5
c5f4d658ca9eccbe75ff91090e6259b3

SHA1
7453bafec1e59b27cb80630eb51feb73d57a0268

SHA256
13fb1f733d474d35f6fe75e539cd3b2b117c6bc26c6163de68a0c3c83d7c6207

SHA512
0d5b3c56ea11d967680eda162eab528893936909922973019a32b4fdee46629e655e2a21ead31f16b27cdd0c34809e5fdb9c06de0556384a2dd097be3bf3f349

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56452.exe

Filesize
468KB

MD5
862ba5b2cb1ae8f32dba946371e37328

SHA1
b236c6a729e5d8fbf15d6aa958b87b418621d3f9

SHA256
552f5b44f672d61ce2f4f98e431f2691a42fa026d26eac424b223edd720f8378

SHA512
1abff6cd60f66cb4b32450e848c23942d3a9af23208523351837638f8b5dee057151c12bee590fafd4f59a50ddc125b26c8fc7265955edb5e489ba214f9ae5de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe

Filesize
468KB

MD5
eb4008aed424fd1e5da530e5496a78fd

SHA1
de24c665e77f50ac42786e518f37888168dad1f8

SHA256
c41e8d3c3feabf4cae8272478b91a268a7f4d47bcec7f96d8b73a6005c04509d

SHA512
7aa7f3fa8c860aad59afb9a96db43c2ac0ee12de3f23a07ad2aedbe9459baccc86a725f5330abdcd8b0cfc03101aef3e194d49b8ddc204d032d3182749bd87a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe

Filesize
468KB

MD5
3e4cf8b5f8ab9bccfe0c31a46329de4e

SHA1
211e164feb1dcde4b1f635a8aca6bcbbbc51fbfa

SHA256
1ed9f40deb8ae42e6472dee7c8a8b4cc1d5bf9b3268770cca269c1d66ecbef42

SHA512
5caada46001b52e056cfc033722d31b663fe41c96cc04d670cf6b3965473bcc216b0f4d1e5ead39b4675447589cf412924cb0f3ff6be2cce09ca96630707c390

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59052.exe

Filesize
468KB

MD5
2718d676e39d5984e9f9d8f711c5b549

SHA1
6a865857adcafbc4d31ffcbc111223ce44a9e218

SHA256
c4a6e6a58f8f3c6b873fef537505fe21ead43cfcf8cd6ee94b5401cfcc91ac66

SHA512
63dd0e74483ccfbe0bbe8a3348500ef7746e7dac54cc6302306b78652a95e0a6b21ddd6217734cbbd7b5a69c30249481268bcfc1cf27ae7fd26bc5c0457ead52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe

Filesize
468KB

MD5
a9d99408faa72ab94014da78a6299bd2

SHA1
d49b065be2bffa075a0bd6c3118d56f49ffb9a93

SHA256
bdedbb22148b46bef87bca814b848d3c2a52050c2f5520d640dd5fa5011baeab

SHA512
9899da2b63b28d237feda87363a72abd706479f24cc7d739073fb984ba99fe60bcaa278aa0fec628c7d7ecd633b727a4a3dc5e05c96faae2b719f749d2d33bba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe

Filesize
468KB

MD5
a96506b1a12068b95d1209d71d91cec0

SHA1
7f55f3f8901a94e6f18e7ff7c71ceb89311bbdf8

SHA256
03319bae10a754a20cbf300dc0a6b51bd595578513fc989ce659bafc2b48fd6e

SHA512
2f6c0101646bee6ebb5bfdd7065aac55d41752957f3186c2179cdf5a6a24a6d8bd37b293975e8d5e36521bcfdd394a00a87b1bcfd88a7d996e8331f63f19e7da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-762.exe

Filesize
468KB

MD5
00a5ca6a8090accca01b5139fccba724

SHA1
a14b911148b87643ad522979d12d99b07869ec10

SHA256
c5fb81a5920c12e966b92969063465ee3469e4a6149997762914b8329e72cb39

SHA512
8dd8d69d5ecb5dbdc20668ed0f2c34d9fbbd5e6ca122e6f31c99988f378248eafa2b745d9b6b02f67c9b111244e540647b4c260d29b0ca9916d07e330d45f922

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe

Filesize
468KB

MD5
48fc5ab6f547833a4a61c723497a3802

SHA1
25648c72df0f428584fc92a7bbf678edd781d8cd

SHA256
1472890d0da168147bcf1ef759093f3e7a74592df1ca0657c91df546ba4bf503

SHA512
c4b64765ceb38677eaefb57e5af8b7797c903fda3a01b4adb0bbbb5d6112cd238c502d6779eb6078569213eb837ecb6f2f67e2b33cf4c6fc9fced979d0879533

Download Submit
memory/324-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/624-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/628-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1164-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1172-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1388-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1392-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1428-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1572-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1820-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1968-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-2750-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2180-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2472-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3108-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3140-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3156-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3260-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3300-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3312-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3444-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3536-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3580-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3696-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3752-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3796-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4008-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4052-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4056-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4060-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4084-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4104-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4272-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4284-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4440-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4724-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4760-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4768-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4824-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4888-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4952-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5060-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5060-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5124-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5228-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5488-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5504-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5548-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5560-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5580-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5604-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5660-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5732-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5756-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5828-559-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14248-3043-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14880-2749-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads