f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cd

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe
Size

468KB
MD5

fc15529cad69a472b33470eed404e010
SHA1

da7d2ab67b4186d63c5c28d546145f03d43e9deb
SHA256

f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cd
SHA512

3dbb0b98a39d764d424b64bdef554109679779750e3dd87be7dd521403dfc493fc42ff21ba63b7df8291830615b476238dd816eebabca7a0befc24890ea0f1a3
SSDEEP

3072:WqMFo7Lgjy8nBbYkPz5jtfLeYqjWRp9nmHeoVWOoG2FUGE1G9uP:WqmooLnB3P1jtf7XLCoGynE1G

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2896	Unicorn-25110.exe
3264	Unicorn-10693.exe
4296	Unicorn-56365.exe
4460	Unicorn-10221.exe
1560	Unicorn-39002.exe
2980	Unicorn-32871.exe
2996	Unicorn-2800.exe
2360	Unicorn-28670.exe
4436	Unicorn-36838.exe
2668	Unicorn-25140.exe
4056	Unicorn-25140.exe
4964	Unicorn-61150.exe
4028	Unicorn-63188.exe
4576	Unicorn-3781.exe
432	Unicorn-24129.exe
1696	Unicorn-40236.exe
5012	Unicorn-23346.exe
4136	Unicorn-11648.exe
1368	Unicorn-49194.exe
5020	Unicorn-4824.exe
3032	Unicorn-24690.exe
3920	Unicorn-24425.exe
3136	Unicorn-24690.exe
1720	Unicorn-24690.exe
1528	Unicorn-32858.exe
1664	Unicorn-41026.exe
228	Unicorn-34895.exe
2868	Unicorn-28011.exe
4572	Unicorn-17076.exe
1968	Unicorn-51040.exe
3564	Unicorn-22718.exe
1816	Unicorn-14357.exe
2640	Unicorn-16395.exe
4908	Unicorn-22526.exe
3972	Unicorn-60050.exe
2020	Unicorn-10849.exe
3088	Unicorn-19764.exe
1692	Unicorn-53728.exe
1036	Unicorn-39992.exe
4704	Unicorn-64689.exe
1936	Unicorn-64689.exe
4832	Unicorn-23102.exe
448	Unicorn-57118.exe
4984	Unicorn-7917.exe
3808	Unicorn-16278.exe
3960	Unicorn-16278.exe
3084	Unicorn-32349.exe
4408	Unicorn-40782.exe
636	Unicorn-40782.exe
2444	Unicorn-48758.exe
1852	Unicorn-56164.exe
4120	Unicorn-11544.exe
4508	Unicorn-57481.exe
2060	Unicorn-11809.exe
2180	Unicorn-304.exe
3428	Unicorn-304.exe
916	Unicorn-11040.exe
4144	Unicorn-9955.exe
4872	Unicorn-58405.exe
620	Unicorn-53382.exe
2948	Unicorn-21072.exe
412	Unicorn-46366.exe
1340	Unicorn-42836.exe
2468	Unicorn-62702.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2984	2360	WerFault.exe	96
16372	13876	WerFault.exe	678
16380	14544	WerFault.exe	695

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9709.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	14168	dwm.exe
Token: SeChangeNotifyPrivilege	14168	dwm.exe
Token: 33	14168	dwm.exe
Token: SeIncBasePriorityPrivilege	14168	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe
2896	Unicorn-25110.exe
4296	Unicorn-56365.exe
3264	Unicorn-10693.exe
4460	Unicorn-10221.exe
1560	Unicorn-39002.exe
2996	Unicorn-2800.exe
2980	Unicorn-32871.exe
2360	Unicorn-28670.exe
4436	Unicorn-36838.exe
2668	Unicorn-25140.exe
4056	Unicorn-25140.exe
4964	Unicorn-61150.exe
4028	Unicorn-63188.exe
4576	Unicorn-3781.exe
432	Unicorn-24129.exe
1696	Unicorn-40236.exe
5012	Unicorn-23346.exe
1368	Unicorn-49194.exe
4136	Unicorn-11648.exe
5020	Unicorn-4824.exe
3136	Unicorn-24690.exe
3032	Unicorn-24690.exe
1720	Unicorn-24690.exe
1528	Unicorn-32858.exe
4572	Unicorn-17076.exe
2868	Unicorn-28011.exe
228	Unicorn-34895.exe
3920	Unicorn-24425.exe
1664	Unicorn-41026.exe
1968	Unicorn-51040.exe
3564	Unicorn-22718.exe
1816	Unicorn-14357.exe
2640	Unicorn-16395.exe
4908	Unicorn-22526.exe
3972	Unicorn-60050.exe
2020	Unicorn-10849.exe
1692	Unicorn-53728.exe
3088	Unicorn-19764.exe
1936	Unicorn-64689.exe
1036	Unicorn-39992.exe
4704	Unicorn-64689.exe
4832	Unicorn-23102.exe
448	Unicorn-57118.exe
4408	Unicorn-40782.exe
3960	Unicorn-16278.exe
3084	Unicorn-32349.exe
3808	Unicorn-16278.exe
4508	Unicorn-57481.exe
2180	Unicorn-304.exe
2444	Unicorn-48758.exe
4120	Unicorn-11544.exe
3428	Unicorn-304.exe
1852	Unicorn-56164.exe
2060	Unicorn-11809.exe
4984	Unicorn-7917.exe
636	Unicorn-40782.exe
4144	Unicorn-9955.exe
916	Unicorn-11040.exe
620	Unicorn-53382.exe
2948	Unicorn-21072.exe
4872	Unicorn-58405.exe
412	Unicorn-46366.exe
2468	Unicorn-62702.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 2896	440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe	82
PID 440 wrote to memory of 2896	440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe	82
PID 440 wrote to memory of 2896	440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe	82
PID 2896 wrote to memory of 3264	2896	Unicorn-25110.exe	85
PID 2896 wrote to memory of 3264	2896	Unicorn-25110.exe	85
PID 2896 wrote to memory of 3264	2896	Unicorn-25110.exe	85
PID 440 wrote to memory of 4296	440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe	86
PID 440 wrote to memory of 4296	440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe	86
PID 440 wrote to memory of 4296	440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe	86
PID 3264 wrote to memory of 4460	3264	Unicorn-10693.exe	89
PID 3264 wrote to memory of 4460	3264	Unicorn-10693.exe	89
PID 3264 wrote to memory of 4460	3264	Unicorn-10693.exe	89
PID 4296 wrote to memory of 1560	4296	Unicorn-56365.exe	90
PID 4296 wrote to memory of 1560	4296	Unicorn-56365.exe	90
PID 4296 wrote to memory of 1560	4296	Unicorn-56365.exe	90
PID 440 wrote to memory of 2980	440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe	91
PID 440 wrote to memory of 2980	440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe	91
PID 440 wrote to memory of 2980	440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe	91
PID 2896 wrote to memory of 2996	2896	Unicorn-25110.exe	92
PID 2896 wrote to memory of 2996	2896	Unicorn-25110.exe	92
PID 2896 wrote to memory of 2996	2896	Unicorn-25110.exe	92
PID 1560 wrote to memory of 2360	1560	Unicorn-39002.exe	96
PID 1560 wrote to memory of 2360	1560	Unicorn-39002.exe	96
PID 1560 wrote to memory of 2360	1560	Unicorn-39002.exe	96
PID 4460 wrote to memory of 4436	4460	Unicorn-10221.exe	97
PID 4460 wrote to memory of 4436	4460	Unicorn-10221.exe	97
PID 4460 wrote to memory of 4436	4460	Unicorn-10221.exe	97
PID 3264 wrote to memory of 2668	3264	Unicorn-10693.exe	98
PID 3264 wrote to memory of 2668	3264	Unicorn-10693.exe	98
PID 3264 wrote to memory of 2668	3264	Unicorn-10693.exe	98
PID 4296 wrote to memory of 4056	4296	Unicorn-56365.exe	99
PID 4296 wrote to memory of 4056	4296	Unicorn-56365.exe	99
PID 4296 wrote to memory of 4056	4296	Unicorn-56365.exe	99
PID 2996 wrote to memory of 4964	2996	Unicorn-2800.exe	100
PID 2996 wrote to memory of 4964	2996	Unicorn-2800.exe	100
PID 2996 wrote to memory of 4964	2996	Unicorn-2800.exe	100
PID 2896 wrote to memory of 4028	2896	Unicorn-25110.exe	101
PID 2896 wrote to memory of 4028	2896	Unicorn-25110.exe	101
PID 2896 wrote to memory of 4028	2896	Unicorn-25110.exe	101
PID 2980 wrote to memory of 4576	2980	Unicorn-32871.exe	102
PID 2980 wrote to memory of 4576	2980	Unicorn-32871.exe	102
PID 2980 wrote to memory of 4576	2980	Unicorn-32871.exe	102
PID 440 wrote to memory of 432	440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe	103
PID 440 wrote to memory of 432	440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe	103
PID 440 wrote to memory of 432	440	f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe	103
PID 1560 wrote to memory of 1696	1560	Unicorn-39002.exe	106
PID 1560 wrote to memory of 1696	1560	Unicorn-39002.exe	106
PID 1560 wrote to memory of 1696	1560	Unicorn-39002.exe	106
PID 4436 wrote to memory of 5012	4436	Unicorn-36838.exe	107
PID 4436 wrote to memory of 5012	4436	Unicorn-36838.exe	107
PID 4436 wrote to memory of 5012	4436	Unicorn-36838.exe	107
PID 4460 wrote to memory of 4136	4460	Unicorn-10221.exe	108
PID 4460 wrote to memory of 4136	4460	Unicorn-10221.exe	108
PID 4460 wrote to memory of 4136	4460	Unicorn-10221.exe	108
PID 4576 wrote to memory of 1368	4576	Unicorn-3781.exe	110
PID 4576 wrote to memory of 1368	4576	Unicorn-3781.exe	110
PID 4576 wrote to memory of 1368	4576	Unicorn-3781.exe	110
PID 2980 wrote to memory of 5020	2980	Unicorn-32871.exe	111
PID 2980 wrote to memory of 5020	2980	Unicorn-32871.exe	111
PID 2980 wrote to memory of 5020	2980	Unicorn-32871.exe	111
PID 4056 wrote to memory of 3032	4056	Unicorn-25140.exe	112
PID 4056 wrote to memory of 3032	4056	Unicorn-25140.exe	112
PID 4056 wrote to memory of 3032	4056	Unicorn-25140.exe	112
PID 4028 wrote to memory of 3136	4028	Unicorn-63188.exe	114

C:\Users\Admin\AppData\Local\Temp\f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe
"C:\Users\Admin\AppData\Local\Temp\f16015d6b7fa37d973807a557ca1032098ea3da0d9c4671fe7ee995be555e6cdN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10221.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16766.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19270.exe
        9⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
        10⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        10⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        10⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
        10⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        10⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        9⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
        9⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        8⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19823.exe
        9⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        8⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        8⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        8⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        8⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
        8⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61308.exe
        8⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
        8⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        8⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        7⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        7⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        7⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64689.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30222.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32098.exe
        9⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        9⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        9⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        8⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
        8⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        8⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        8⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        8⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64400.exe
        8⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23139.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
        7⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
        7⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34371.exe
        6⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe
        8⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        7⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        7⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        7⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50245.exe
        6⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
        6⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11648.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46366.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        8⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52902.exe
        9⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        9⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42131.exe
        9⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50557.exe
        9⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30260.exe
        8⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19058.exe
        9⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        9⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        8⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29255.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        8⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        8⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        9⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
        8⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11916.exe
        8⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        8⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1855.exe
        7⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        7⤵
        
        PID:15456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42836.exe
        6⤵
        Executes dropped EXE
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57222.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39108.exe
        8⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10572.exe
        8⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32190.exe
        8⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51833.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25918.exe
        8⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
        8⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35408.exe
        7⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        7⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        7⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11595.exe
        6⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35378.exe
        8⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47573.exe
        8⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25115.exe
        8⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        7⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58692.exe
        7⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15496.exe
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        6⤵
        
        PID:14888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        6⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe
        6⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        7⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        8⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56094.exe
        9⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe
        9⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54280.exe
        9⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        8⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31557.exe
        8⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8880.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        7⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5972.exe
        7⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58929.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        8⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        8⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exe
        8⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe
        7⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62345.exe
        7⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28811.exe
        6⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        7⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6227.exe
        7⤵
        
        PID:11660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63308.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        6⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18164.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
        5⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
        7⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
        8⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
        7⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        7⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
        7⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8527.exe
        6⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19519.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4957.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        6⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        6⤵
        
        PID:15436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        5⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
        5⤵
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25140.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57118.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26138.exe
        7⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
        8⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
        9⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56177.exe
        9⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55603.exe
        9⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        8⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        8⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        8⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        8⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        8⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63056.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33245.exe
        7⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        7⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39712.exe
        6⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        8⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        8⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62345.exe
        8⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        7⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50856.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
        7⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
        7⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46981.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-179.exe
        6⤵
        
        PID:14256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
        6⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        6⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53530.exe
        7⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27210.exe
        8⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        8⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8740.exe
        7⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29263.exe
        7⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        7⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
        7⤵
        
        PID:13936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        6⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17459.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        6⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44506.exe
        7⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        7⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        6⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        6⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52637.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe
        6⤵
        
        PID:15316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        5⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57157.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51626.exe
        5⤵
        
        PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        8⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40389.exe
        8⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        7⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20130.exe
        7⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27608.exe
        6⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34343.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38637.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        6⤵
        
        PID:14232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56986.exe
        6⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7296.exe
        7⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        6⤵
        
        PID:15672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        6⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
        5⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15460.exe
        5⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
        5⤵
        
        PID:14388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56646.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24750.exe
        6⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        7⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        7⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        6⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29263.exe
        6⤵
        
        PID:12560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        6⤵
        
        PID:8
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        5⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17222.exe
        6⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        5⤵
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
        5⤵
        
        PID:11692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37191.exe
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21900.exe
        5⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        6⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
        6⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51744.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        5⤵
        
        PID:15128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37383.exe
        5⤵
        
        PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
      4⤵
      PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
      4⤵
      PID:14396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe
      4⤵
      PID:9396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2800.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
        9⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8344.exe
        9⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1531.exe
        8⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
        8⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        8⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11568.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        8⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7872.exe
        8⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28007.exe
        7⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64817.exe
        7⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
        7⤵
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62326.exe
        7⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        7⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
        7⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59669.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        6⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54384.exe
        6⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-304.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe
        6⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46058.exe
        8⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        7⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13487.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
        6⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        5⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        6⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
        6⤵
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        5⤵
        
        PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        5⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21729.exe
        5⤵
        
        PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17076.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48758.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        7⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        7⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55576.exe
        6⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        6⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        6⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        7⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        7⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        6⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        6⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        5⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39956.exe
        5⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34541.exe
        5⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9524.exe
        5⤵
        
        PID:12172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
      4⤵
      PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12305.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1659.exe
        6⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        5⤵
        
        PID:13460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
      4⤵
      PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
        5⤵
        
        PID:11476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
        5⤵
        
        PID:15140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
        5⤵
        
        PID:60
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
      4⤵
      PID:9420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2105.exe
      4⤵
      PID:13212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
      4⤵
      PID:5300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        6⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46122.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16006.exe
        8⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        9⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26000.exe
        9⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52744.exe
        9⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56213.exe
        8⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56352.exe
        8⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41886.exe
        8⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe
        8⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        7⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
        7⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
        6⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        8⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe
        8⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        8⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26141.exe
        7⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51677.exe
        6⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        6⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5504.exe
        5⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33870.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36264.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64765.exe
        7⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        7⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18008.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        7⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54520.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
        6⤵
        
        PID:14544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14544 -s 468
        7⤵
        Program crash
        
        PID:16380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29222.exe
        6⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6743.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45466.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9709.exe
        7⤵
        
        PID:15672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
        6⤵
        
        PID:13876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13876 -s 464
        7⤵
        Program crash
        
        PID:16372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        6⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14064.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32607.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        5⤵
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42773.exe
        5⤵
        
        PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64689.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43818.exe
        5⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        7⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        7⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        7⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        6⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50520.exe
        6⤵
        
        PID:14520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        6⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        6⤵
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        5⤵
        
        PID:9284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        5⤵
        
        PID:12812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18511.exe
        5⤵
        
        PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34371.exe
      4⤵
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29322.exe
        5⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        5⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe
        5⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        5⤵
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
      4⤵
      PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
      4⤵
      PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
      4⤵
      PID:14664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
        6⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        6⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48133.exe
        5⤵
        
        PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28007.exe
        5⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1243.exe
        5⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43360.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        5⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        5⤵
        
        PID:16036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        5⤵
        
        PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31115.exe
      4⤵
      PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5651.exe
        5⤵
        
        PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe
      4⤵
      PID:11216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
      4⤵
      PID:15648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
      4⤵
      PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18953.exe
      4⤵
      PID:10288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59578.exe
      4⤵
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56078.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43790.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        6⤵
        
        PID:12448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8182.exe
        6⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60036.exe
        6⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        5⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        5⤵
        
        PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38516.exe
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        5⤵
        
        PID:10664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        5⤵
        
        PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
      4⤵
      PID:12804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37862.exe
      4⤵
      PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
      4⤵
      PID:11604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2976.exe
    3⤵
    PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
      4⤵
      PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
      4⤵
      PID:10616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42131.exe
      4⤵
      PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41726.exe
    3⤵
    PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63513.exe
      4⤵
      PID:4380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55223.exe
    3⤵
    PID:10376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
    3⤵
    PID:14724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27123.exe
    3⤵
    PID:10436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 724
        5⤵
        Program crash
        
        PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40236.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53382.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16766.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23930.exe
        8⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        8⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        8⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9709.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
        7⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
        7⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51901.exe
        7⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61861.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        7⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe
        7⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
        7⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50000.exe
        6⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe
        6⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21072.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
        6⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        7⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43283.exe
        7⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        6⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53845.exe
        7⤵
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
        6⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
        6⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18227.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe
        6⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38776.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6051.exe
        6⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49180.exe
        6⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15216.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        5⤵
        
        PID:11296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24760.exe
        5⤵
        
        PID:9892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21862.exe
        5⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe
        8⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        8⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
        8⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        7⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26141.exe
        7⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        7⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
        6⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60004.exe
        6⤵
        
        PID:14156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        6⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        6⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
        5⤵
        
        PID:8336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60760.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exe
        5⤵
        
        PID:16212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41825.exe
      4⤵
      PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8844.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6051.exe
        6⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        5⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        5⤵
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15616.exe
        5⤵
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        5⤵
        
        PID:10416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8411.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        5⤵
        
        PID:10068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11531.exe
        5⤵
        
        PID:14048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        5⤵
        
        PID:15164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
        5⤵
        
        PID:8480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9476.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4065.exe
        5⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33138.exe
      4⤵
      PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
      4⤵
      PID:15036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe
      4⤵
      PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25140.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60050.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        6⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        8⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        8⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
        8⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        7⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        7⤵
        
        PID:16060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61677.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26000.exe
        7⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56480.exe
        7⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33245.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        6⤵
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38176.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exe
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        7⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
        7⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        7⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20983.exe
        6⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8287.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
        6⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29971.exe
        5⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54628.exe
        5⤵
        
        PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19764.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63086.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        7⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33579.exe
        7⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37660.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9979.exe
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        6⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21246.exe
        6⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17136.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56176.exe
        6⤵
        
        PID:15508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
        6⤵
        
        PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29299.exe
        5⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5780.exe
        5⤵
        
        PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57916.exe
      4⤵
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        6⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
        6⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52745.exe
        6⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        5⤵
        
        PID:12860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        5⤵
        
        PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42156.exe
      4⤵
      PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
      4⤵
      PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe
      4⤵
      PID:3824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23102.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46558.exe
        5⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41272.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53877.exe
        7⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30981.exe
        7⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3141.exe
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55637.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43543.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
        5⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        5⤵
        
        PID:10828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61285.exe
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65398.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34168.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32022.exe
        6⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59065.exe
        5⤵
        
        PID:11656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        5⤵
        
        PID:12592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe
      4⤵
      PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
      4⤵
      PID:12676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15806.exe
      4⤵
      PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24750.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
        6⤵
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53857.exe
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54220.exe
        5⤵
        
        PID:10348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
      4⤵
      PID:736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36787.exe
        5⤵
        
        PID:9916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
      4⤵
      PID:10132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
      4⤵
      PID:14072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26570.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46319.exe
      4⤵
      PID:9816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49444.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
      4⤵
      PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
      4⤵
      PID:12256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
      4⤵
      PID:15892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe
    3⤵
    PID:8376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
    3⤵
    PID:11820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
    3⤵
    PID:15076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32871.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32871.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62702.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57222.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        9⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        9⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47207.exe
        9⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        8⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43628.exe
        8⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        8⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
        7⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        7⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        7⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54845.exe
        6⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        7⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        7⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64976.exe
        7⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60760.exe
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        6⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
        5⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40178.exe
        7⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        7⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        6⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35800.exe
        6⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe
        5⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44330.exe
        7⤵
        
        PID:13344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        6⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        6⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15216.exe
        5⤵
        
        PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe
        5⤵
        
        PID:14444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39992.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        5⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        6⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        7⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        6⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        7⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14863.exe
        6⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48657.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        6⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        5⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18511.exe
        5⤵
        
        PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34371.exe
      4⤵
      PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15164.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25954.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29020.exe
        6⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53877.exe
        6⤵
        
        PID:15732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61349.exe
        6⤵
        
        PID:9900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46788.exe
        5⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35129.exe
        5⤵
        
        PID:12460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45865.exe
      4⤵
      PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35372.exe
        5⤵
        
        PID:14040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        5⤵
        
        PID:10184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
      4⤵
      PID:9228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9928.exe
      4⤵
      PID:12604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36810.exe
        6⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        7⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23999.exe
        7⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27816.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34276.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        6⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52113.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
        6⤵
        
        PID:14116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53543.exe
        6⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
        5⤵
        
        PID:12792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14004.exe
      4⤵
      PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        5⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        5⤵
        
        PID:10460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        5⤵
        
        PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
      4⤵
      PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55430.exe
        5⤵
        
        PID:13488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27905.exe
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58508.exe
      4⤵
      PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36267.exe
      4⤵
      PID:15056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21626.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6597.exe
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5879.exe
        6⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        6⤵
        
        PID:11644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
        5⤵
        
        PID:13372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        5⤵
        
        PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45289.exe
      4⤵
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13473.exe
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        5⤵
        
        PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41116.exe
      4⤵
      PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16820.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7458.exe
      4⤵
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
    3⤵
    PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
      4⤵
      PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59965.exe
      4⤵
      PID:11828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
      4⤵
      PID:15172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59761.exe
      4⤵
      PID:10640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39416.exe
    3⤵
    PID:8396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
    3⤵
    PID:11812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33219.exe
    3⤵
    PID:10420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56646.exe
        5⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41278.exe
        6⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
        7⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        7⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
        7⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        6⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29263.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18152.exe
        6⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23716.exe
        5⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7500.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14422.exe
        5⤵
        
        PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50761.exe
      4⤵
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18990.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        5⤵
        
        PID:11320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6051.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
        5⤵
        
        PID:11608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9351.exe
      4⤵
      PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
      4⤵
      PID:11756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32571.exe
      4⤵
      PID:14552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-304.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
      4⤵
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        5⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        6⤵
        
        PID:12832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57191.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        6⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65288.exe
        5⤵
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38360.exe
        5⤵
        
        PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33036.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        5⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35583.exe
        5⤵
        
        PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41116.exe
      4⤵
      PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53680.exe
      4⤵
      PID:16232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
    3⤵
    PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
      4⤵
      PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11916.exe
      4⤵
      PID:15100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
      4⤵
      PID:10580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
    3⤵
    PID:8012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
    3⤵
    PID:10576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
    3⤵
    PID:14964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28011.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28011.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11809.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
      4⤵
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4137.exe
        5⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1166.exe
        6⤵
        
        PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
        5⤵
        
        PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
      4⤵
      PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15464.exe
        5⤵
        
        PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
      4⤵
      PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39021.exe
      4⤵
      PID:12688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
      4⤵
      PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14223.exe
      4⤵
      PID:10896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
    3⤵
    PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18886.exe
      4⤵
      PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27978.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        5⤵
        
        PID:14980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
      4⤵
      PID:10052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26331.exe
      4⤵
      PID:14064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
    3⤵
    PID:6544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63308.exe
    3⤵
    PID:11108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
    3⤵
    PID:15520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64433.exe
    3⤵
    PID:3192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
    3⤵
    PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
      4⤵
      PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2321.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12863.exe
        5⤵
        
        PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
      4⤵
      PID:12880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
    3⤵
    PID:5952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
    3⤵
    PID:10328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1907.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61504.exe
    3⤵
    PID:1028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7789.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7789.exe
  2⤵
  PID:5784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40458.exe
    3⤵
    PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17610.exe
      4⤵
      PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe
      4⤵
      PID:14456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31830.exe
      4⤵
      PID:7704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51360.exe
    3⤵
    PID:10524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
    3⤵
    PID:14956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
    3⤵
    PID:11432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29515.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
  2⤵
  PID:11188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
  2⤵
  PID:712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53200.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53200.exe
  2⤵
  PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2360 -ip 2360
1⤵
PID:1668

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10221.exe

Filesize
468KB

MD5
3b18c4ca88925ff599e37d2ad8ab36af

SHA1
db334840c4506256290efcd330923f90556077be

SHA256
69abe89f021dc1947483dbe39af7d9e7651578c0f98046f502b9e978738c217a

SHA512
d9f09a4b27ed679fde2513eaa964c0fefdbfc9295b0c3cde786c0a0258816a8e6e59c27f70b408e6a544d7c6162aab8f5960e0182fa6e08b0680ea457ec1ed4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe

Filesize
468KB

MD5
264d9c989ceed0fd9f649e7d48a615f1

SHA1
eb11ad9329a2cd3ad5571ae54526116d398fbcb8

SHA256
b6bcf7b5cc701036a8dc189611858972d344c3059e01e396acb7080c8b6519e9

SHA512
7dc779a30524ab863b0ce04933c19067462b272cc664580ee58d82dc265aef67c94c32bc840c1006b62d025fed724b7ba97ff37ab5d91fbd50fcd500750ad5be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11648.exe

Filesize
468KB

MD5
498024a889b684dbe6c69265306a7e58

SHA1
8c3820de4d122a79d63a3740ca6224b75e5bf3f3

SHA256
9fe835078904488c5307053a888768e58bb7630938ea7812dc873484aa3fc4f3

SHA512
cb4986e4dc713d543ba2669572d5eb79962aa593017479df8806503518f90786a91c29da851e480df9a262a9b41172eecc1e0c67a5e85fa5abbc6ab1ea89c670

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe

Filesize
468KB

MD5
8762f33330ff25f1c30c8f80686cb0cb

SHA1
2c76d9c48219c19f631be04d336e128fc9f5603a

SHA256
bcd89a5bc583b10183220cbaacfef50311871a12c0aad3b39e3b178bcbfe51d8

SHA512
3eef68a3a9891aeed233749f1913d65c0478af35e03fe0083c871e61245a0cf2e8d6909c19d44b2d7ac6a49b9efd3cfc9d1ab1adf9ac061af97fcf3d44fe261b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe

Filesize
468KB

MD5
6c794d232e1f3defd55d2c715c7696da

SHA1
5a99780eee23064b601ad43f2131e72813e75ee2

SHA256
9d06e085ae491d7e851216d46e2daec8c9086fde2a82f86ecbbf8eada50d1fd0

SHA512
3f047f9ef5ce2e4538a032897f40b4f99c6a256a5951d0a681c788f7a14aab6bcec963abc45545fb785817a37098d4ff1df6c5466a526d425062b5fa78db50b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe

Filesize
468KB

MD5
3feda00e62301aab620f752f3c0f7e76

SHA1
4e69bee34d4ce446601e11aba365b67f5aca0fdd

SHA256
8588715f14cdc6a03bc1edb92e2f4c0dd88307a72e62a381f5f128c5890561bd

SHA512
247d351d5514574366b7ce83ce0d03ffb655807dfb4594872d76a25df3968095d44f0ba39d22eab6fffb90db9489cc48caba049d44ffe9a41811f6914b8dafe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17076.exe

Filesize
468KB

MD5
fbf02d4f4be3a9a90e519956ae18b495

SHA1
79850874905d4d52784b782a3bc01d6b467154d5

SHA256
39e616dc69cac987be2621823ab81573636cd50028b2a1ba1c6175ad9c2661b2

SHA512
4b78a72d0afb1524a193887de09a121a90336ea6a15565fe7b5f6bcf121e56cbaa2a5308d46434b1bdbf0ce0e19629461fa4e7c15e31da28194a87d0835b6314

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe

Filesize
468KB

MD5
703d441ade6e88c2726c7bb55aa45e5d

SHA1
ff84c4aca4881f55d8665d6df4135e39082e9c73

SHA256
1509fbd99b981c5b005f9ef256ecab4ae51295b2bff16ee23713ab526ff0c23d

SHA512
11ecf5da40dc5656354a893a10ce44162c20132133da5ace6c558e436990af7859d1203a238e67106c75fe9f6cc3e1ccba98bff6fb91bdb236dc1c8cd2192bba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23346.exe

Filesize
468KB

MD5
4fe25fae51770c4084493235384538ad

SHA1
d2d235b968c30b9f0de98baa80cfa0ec8194c311

SHA256
126ff494e17430dabd3df0fcc242b1f88c705fc61628afacda08a3704e67171f

SHA512
9fe42940dd26386426fa856efacd24b93ddcc5ba594d702de7fbc57ae74d05b03e68295ecf06dffbfc9a4e0a1223b95d5044a02c3f7986a9baa5ad7e1db80b2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe

Filesize
468KB

MD5
34f2201b114441bb93629385081af485

SHA1
1b6f7509d6e3717e66a014d24f137446569ed4a0

SHA256
35ca7ebf136dd0ef8831da8f72b689922bade6dbde98422cb2ac84340122a13d

SHA512
333d7ce15cf67d3b1bbe931d6f464062a576e88af1d9539587bef7dd41b0dad38ac268336fd0487079b6d724151f48cfc3ae873501fbe36e0207ab63a731a114

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe

Filesize
468KB

MD5
7abfcd1dde6854bea20cc4a6db05b926

SHA1
a6bf0eba6b1669071f4f3d3a17fd2ba901ad635e

SHA256
6fdd05bbc32f615b782b35926dd102e5dc78c4dc07dd1c842160459e4dbdd412

SHA512
18102505731879d01f62cf291490c71961f5029b7091c5835aa138916d1a1554e0d141d48bc630c1ba04d182da9640070b7bbb91ac97201060703f70b2c8b621

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24690.exe

Filesize
468KB

MD5
f7e4111b01945b31e5e4138ef69b30bd

SHA1
eb8b9448b7162cc4448ea37307a74c230733dd16

SHA256
80fc051bdafd1e00d5f8e346175e1a6b88349ec3cce1fe7436d37ee29d35b8f0

SHA512
b0fa645e32c622758e463486fc35e6d795fb45fe8c3ee8b45fba10c4e8ceec59fd8470f3a78307cb9cb5d9f247058af94f80b6e0583a44260f256244a1041b44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe

Filesize
468KB

MD5
c96b2b50eeda0b88aae601d33e458ffd

SHA1
3c6443a84d417e342328124f6ca2ae23c9686f39

SHA256
b97337f8fa30e53084a95c7b9c6b3047b287bc84ca43220859936f7ed89f0bf1

SHA512
9dbc7b3da5ee51390efcb8efbca6a6faa8365b68102297f908676cb1b2a06f8afd20223baa2b2eaa7e840654964c2a2f26a2a2161225c05af01cc7740accf4cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25140.exe

Filesize
468KB

MD5
f472cdadbb7b9fa3f2ef3bef18c5466a

SHA1
e17fb4c8694a33ac7b6f72fa01960dfea6b3ddc5

SHA256
f0ba56ac63975afa80b35c3a835d2bd97aad7b152a060bee43cb07e16023cabd

SHA512
1e037d3d0e5fefccf7f4afd5aa227cbedb679858087f5abc9f952bd77f8803795a2da6daa28631eec8274a5aa839f6c05d586e6bff7259c4b2c4ae327af43d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25378.exe

Filesize
468KB

MD5
9dc721a08950a96450a9ecd8ff2b04b0

SHA1
7ff838f7dff16c7e3b426cd1afd570e8369b7720

SHA256
f9548a4526dd7a85a45a45083b790a77bd2606e1f5b5a13690c3d57bd40d3f16

SHA512
f8638d1dda4cae6ad850dda4bbba904ec427d9c621868cd6a152b2cb6210dd3739d7f3482ffc0eebd5973bc682cf1e65cccc7ce72dc5fafa21d838229feccd62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2800.exe

Filesize
468KB

MD5
9810cfbb4bd116ad8a0ce5dc13be7c73

SHA1
72ecb70d18c5935e07193fe69416967ec77a934e

SHA256
4a29600bb143b36dc0866549257a9ea85209363a369131db9f380f4b53729c43

SHA512
5aadb45426af467c1be03704c3722c81618d4cc53f0869c1338062648eacf36734999a322a86d975579fe16100cea9be8055756248f4707226c40f38bcfe9ee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28011.exe

Filesize
468KB

MD5
3d19cbb4ebec5de73f51bf41ed3ca41d

SHA1
fcb2475dbd35994c0e83e3a2494930a21392f0d3

SHA256
5f598e8d036dfb964e8b0cde8bc8c82c3566f3e4f665f85e7126486bf2ead434

SHA512
376e6d3b71b253e738834b5f0ba66032fccf393b29045de0696b85fdf13b9bbdfa866c3c0764ffbdf5b66b19b7724a8119779a3fffd3f662ab66038efe744402

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28670.exe

Filesize
468KB

MD5
9a650a84f5d09f9bf6456b681a8d1a38

SHA1
6c4493ccf698b6b9576e51caa39311ffad3a128c

SHA256
9691c70beff60e90c6147ca93481ccf8b2fbba0b8a566497af4abc462cb0885d

SHA512
37ebfd5bba2c1d8b6872352df42a7708ef2b47b9b13a5be9a12a031fd029f4f3821c150337af19338cfdb2a420437b32c0fabc5ed82859eab6ebe98d0bb439fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe

Filesize
468KB

MD5
b1d4bc29cdfb9d3834c0c179bc6dd626

SHA1
3438b122bef7f3a5865fec7c8ba34253f7036d0b

SHA256
8abde5e96fccc6c184b63d1c47e96561beebad76769ac985c20b2a1f9da7c9da

SHA512
cb4049fc37145669720a87365119bcdc4ebc5c712d3179efd5ea74e25dbd72f0aa67c65d0959a6f1fbf0eca02625c761d33a464378a209981b6e36466e83af3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32871.exe

Filesize
468KB

MD5
35b6c3a954f8dad0d985fbc1e62dbb2a

SHA1
3abe208aa3e8d6084b06490a14556a328e16ff81

SHA256
bedd2bf5629ccabc89cb72e438a19f77a24e2449f0152f86baafaa450a360d21

SHA512
7389d6d69d89e038765d60770461bdf37d0b92732909b40322e3fd71268de41ce65690a437fef54767850bf4cc9af896399b3eae19473245b898003aac7da27f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe

Filesize
468KB

MD5
b06bab1e9625818e0739c93d2513e5f5

SHA1
b4ce2e7e45ed9287f33df8029b2df2fe4f0489a5

SHA256
2dd0cfe1aa4376c4735854783a718613a2a434e26d2b12a97f79ae4af9fbced9

SHA512
b6a3ce49320b651b5b31a94ade2cabb8a0b5cea6583913293571127826ec02e4d9f19f20c5413c1846a6f4a9f2bf646c84be2912e603b71c40345a135fb4a6a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe

Filesize
468KB

MD5
f904de7f00f9990d5aec2d02a0455f57

SHA1
7d033ba3ca7da8c64bd45f8dd95b91e391204fb7

SHA256
c4553836bcd604033713c66cf036ad990f4da21f9615cf7f4d54b27639663e77

SHA512
3a0c0bf33a794f99f6dd29f45ef24052cd31e7f79fac5dee03ef58f320f64070fea8023ea58d5297b495dbffd5c2481d4ff47bb8f40fe63fa422a1ea8aeb167f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3781.exe

Filesize
468KB

MD5
e4d1d49b175acf202796755d5feeaf24

SHA1
d731285bffea2e8f43703d24731178a00477c58e

SHA256
070d6cdc7265e8a1e5d0d3bf3ec3970806e0aaa55e5223fa0b48acc2a26a1925

SHA512
0e541d3083baad3cc6f810f1b2b186665807be21da315b6ea0478b8927e330ae0647ac26e8a32ac87af3c01c56f223f68397418180385ad2f8ae48d4ba3992a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe

Filesize
468KB

MD5
25a8716f3dbe040ac2402a5c009e1f10

SHA1
120d0da6ac496dc31dfc8bf4089c42a46c01cb8f

SHA256
84e21f1c7ae0f3857ddbf0a0fbc4cb74f71e60ca652e80cfec4941770d1a8fcf

SHA512
1e0e99026c842a4b53404764b029be90d02b49facd85241f16f958688a32b1e80812d5d72d2003a74289bee850a7911b2ad3ff37d3a6e6b7b8c68dbe379697e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40236.exe

Filesize
468KB

MD5
bd8ef81671d25a242890d56b67d5cba1

SHA1
4cdf1b22510f9eefa4f9cf868435578ccdbd0f3b

SHA256
1c7b3a16689228bb532186e0a1fc62d014fa06506cf5106b4e00beb643cd3abf

SHA512
b62856ed281abca341e2a8369e3e89036bc91fcb61bf54513f99b6a441c8c45aaaa60e0d938bdfc663e851c18e6f8953704808222f8f12f6578234fbcceeaf59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe

Filesize
468KB

MD5
862af359291058e8e03790f27568cd08

SHA1
17fae9c514fa3c3ca9188a11a8a2118f5fc1d784

SHA256
33adffca9c17526833c12935df5770197286540ed752bb4a8fcc4ac8fbb2cebf

SHA512
474d0af482515bedb62766c54d1af91f692484689aa4c5942ab14871301838a4335f904f7f77ce90540dd1e5f0e18f705bbf9c93a72cb67ad6d8a86edc91faed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe

Filesize
468KB

MD5
a8116a3eb7e1830a2c118d6b8551a167

SHA1
f35d3a405ac23df5edab2b93892dda62b3d4ca28

SHA256
4755038a27c971a682a041d6744a96b58cdd448e2d27bfa48994197ba2025809

SHA512
8e5ffcdb4c969a521adfbc7ba9c43f869f2ae820e34ce2ae9459f73914275b0f1c783af1b1f247d1ca184cda2c36b7bb426d74d2a88d5054c1fc057ea072c9e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48657.exe

Filesize
468KB

MD5
8822890e1f46c01d972ae66dd0e652a3

SHA1
6e89e077c4082cbd480153002450cf7148fc2791

SHA256
4e44fcece26b5a24acd609c3cba9e30b0608a1fe0014adc5fee5088ffe4004ec

SHA512
0329dc183154177394111279b366a78dc8a06c066e5b583ffcc6d8960dd77206a691fb7deeaaa9fca30cc4022fc8ae30628e298e19d1f9fb3433b0e1cf548152

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe

Filesize
468KB

MD5
b11120038793ba8befdbfdc8fc64cdfe

SHA1
09261a15e834524c8b8d83838d22167d9cfb3ded

SHA256
946b2519fecbb8faac4c7fe3620fa18bfde6703f3389090314b4d212ff5b16cf

SHA512
7baf6341d8a8561235c520d9950c31ece6fcc4d0c17c654224981106552bba87bbac693833766f94b1da332177cb085528f0cdadb867ad42c1a928680d385968

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe

Filesize
468KB

MD5
05fa6f607e1225aff8125a418e15f6bc

SHA1
4872545296d29508278262000a9bbfe6cf3be06c

SHA256
db6edaf23ca7bc0230421dcb8502538a2968feb9c9164551d1696f1ae8e6fd8a

SHA512
e4d484d81ea338134781c6933a2ebae903ddaea1c13d7f9dc44e2432485cde1e05f57e0f2e2f045f6a5ec69a814bec66665da44850f7bad740090f574d2591af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56365.exe

Filesize
468KB

MD5
2912083e668be7678b6ce1755b7baf52

SHA1
3c39280c076e6fdfd37b35501ee0df423ff22d6c

SHA256
386ab0beecbff5b3458beb79a236921d2d15a918ab345893b4c435b1a3ab5f13

SHA512
62db67f1f1deca8dcaaf2e528c1948033488612709c16876ea9bc591e240a4063347ca4374ca29c8679449532775731dd49b4a5920d6ec1f42f5a338201ad35b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe

Filesize
468KB

MD5
437dcf31e911223d738c2d6f39310315

SHA1
ff968b5aa17be0a1a49e36128aaacca15c863586

SHA256
65e1ec92dacea66e3fb0bdfdb0686a9e06d1b662ce81fddd45566f2a3af0a418

SHA512
3c236814e7e3f2b229f5ed9d20b98725a3e12e2c9a1712f06599032e4e08bcec3f7fbcd5ef7a20106eea71c20b746b53fd175d448e7f5640796670f6e3b477bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe

Filesize
468KB

MD5
a461263bd05f66ee0cb7b49cf8a92ae4

SHA1
7cb36b68076bbb386f0950b09edb47315618850a

SHA256
201714c1392a9c993b0cb60a53edb238cab20174fb885f342e24ea326b06a9c2

SHA512
1d795db1c6783c4461a06ca44ec6915eeae7897256114d0288da9d2a780fedecf084bca8099f8ce8007794812c1507d37f836e7b658d18783c7cb97f7feb170f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe

Filesize
468KB

MD5
23d53d3278cd565788795296ddd54d05

SHA1
5736fd23e317fbc151ca1b467aac6d2e5ef54dc4

SHA256
88a73fbd3ec6cc19e0fb5b593e15cf149fbed5e6a7279bbb71c549a1c287f0eb

SHA512
8e827a882db99703241b139433703754de2850e467b421994fa9670fc0af456b9a79fc9315f231a540d99f8f772c922cc9874aa139a5489de288bba0f26ec681

Download Submit
memory/228-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/412-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/432-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/440-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/620-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/636-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/916-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1036-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1184-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1340-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1368-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1816-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1852-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1968-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2180-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2444-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3032-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3048-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3084-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3088-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3136-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3264-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3428-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3564-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3584-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3808-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3920-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3972-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4028-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4056-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4120-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4160-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4196-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4248-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4576-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4624-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4712-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4832-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4984-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5008-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5148-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5228-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5392-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16072-2620-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads