0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56

Analysis

max time kernel
120s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe
Size

468KB
MD5

7a4bd97f1e0af62f12429eb1e62b1150
SHA1

e3a200b7dcf494697cdc1a69dce86868f4d27db2
SHA256

0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56
SHA512

2aaceeb452e26496b52515dc8571a61991ba6db95271c149b1eb6c9494356cecc95b2b789c87bb9f6d192d62a44ec791284a17b2d03d03bd0003bf0d6824a9d0
SSDEEP

3072:ITfDog4dP08uxbYNWbi/Vf8/Prhjt7p59dHetVpocOa3kjF/o8lY:ITLoH5uxSWW/VfGF4ucO4OF/o

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4732	Unicorn-62623.exe
3804	Unicorn-35571.exe
4684	Unicorn-64906.exe
3692	Unicorn-29863.exe
1772	Unicorn-51030.exe
3268	Unicorn-13526.exe
2408	Unicorn-11480.exe
368	Unicorn-61907.exe
3232	Unicorn-33873.exe
2116	Unicorn-4730.exe
1404	Unicorn-8793.exe
1204	Unicorn-7973.exe
548	Unicorn-14360.exe
2992	Unicorn-36827.exe
1604	Unicorn-8238.exe
1840	Unicorn-35623.exe
3456	Unicorn-44538.exe
2272	Unicorn-10542.exe
4548	Unicorn-12580.exe
4296	Unicorn-7205.exe
1928	Unicorn-27071.exe
4360	Unicorn-48607.exe
4108	Unicorn-13888.exe
3024	Unicorn-15358.exe
3652	Unicorn-27346.exe
2876	Unicorn-52307.exe
1940	Unicorn-60475.exe
4448	Unicorn-12021.exe
4052	Unicorn-31887.exe
1728	Unicorn-35208.exe
3796	Unicorn-24273.exe
3180	Unicorn-25063.exe
756	Unicorn-62758.exe
4968	Unicorn-750.exe
4280	Unicorn-36421.exe
3404	Unicorn-46251.exe
3788	Unicorn-38275.exe
3632	Unicorn-42359.exe
4064	Unicorn-47595.exe
1580	Unicorn-6489.exe
3504	Unicorn-27153.exe
2796	Unicorn-14346.exe
2984	Unicorn-35513.exe
244	Unicorn-43681.exe
2908	Unicorn-63282.exe
1960	Unicorn-32912.exe
3972	Unicorn-2841.exe
3552	Unicorn-30875.exe
2732	Unicorn-60210.exe
4476	Unicorn-59655.exe
3772	Unicorn-59655.exe
3568	Unicorn-44087.exe
1528	Unicorn-11969.exe
1656	Unicorn-48918.exe
4220	Unicorn-3246.exe
2848	Unicorn-5284.exe
3496	Unicorn-15498.exe
1340	Unicorn-15498.exe
3012	Unicorn-29980.exe
4384	Unicorn-27180.exe
3600	Unicorn-10645.exe
1752	Unicorn-39811.exe
4588	Unicorn-65062.exe
3436	Unicorn-56339.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4660	2120	WerFault.exe	209
8172	7440	WerFault.exe	304

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9681.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	11196	dwm.exe
Token: SeChangeNotifyPrivilege	11196	dwm.exe
Token: 33	11196	dwm.exe
Token: SeIncBasePriorityPrivilege	11196	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe
4732	Unicorn-62623.exe
3804	Unicorn-35571.exe
4684	Unicorn-64906.exe
3692	Unicorn-29863.exe
3268	Unicorn-13526.exe
1772	Unicorn-51030.exe
2408	Unicorn-11480.exe
368	Unicorn-61907.exe
3232	Unicorn-33873.exe
2116	Unicorn-4730.exe
1404	Unicorn-8793.exe
548	Unicorn-14360.exe
1204	Unicorn-7973.exe
2992	Unicorn-36827.exe
1604	Unicorn-8238.exe
1840	Unicorn-35623.exe
3456	Unicorn-44538.exe
4548	Unicorn-12580.exe
2272	Unicorn-10542.exe
1928	Unicorn-27071.exe
4296	Unicorn-7205.exe
4360	Unicorn-48607.exe
4108	Unicorn-13888.exe
3024	Unicorn-15358.exe
1940	Unicorn-60475.exe
3652	Unicorn-27346.exe
2876	Unicorn-52307.exe
1728	Unicorn-35208.exe
3796	Unicorn-24273.exe
4448	Unicorn-12021.exe
4052	Unicorn-31887.exe
3180	Unicorn-25063.exe
756	Unicorn-62758.exe
4968	Unicorn-750.exe
4280	Unicorn-36421.exe
3404	Unicorn-46251.exe
3788	Unicorn-38275.exe
3632	Unicorn-42359.exe
4064	Unicorn-47595.exe
1580	Unicorn-6489.exe
3504	Unicorn-27153.exe
2796	Unicorn-14346.exe
2984	Unicorn-35513.exe
244	Unicorn-43681.exe
2908	Unicorn-63282.exe
1960	Unicorn-32912.exe
3972	Unicorn-2841.exe
3772	Unicorn-59655.exe
4476	Unicorn-59655.exe
3552	Unicorn-30875.exe
2732	Unicorn-60210.exe
4384	Unicorn-27180.exe
1340	Unicorn-15498.exe
3568	Unicorn-44087.exe
1656	Unicorn-48918.exe
3012	Unicorn-29980.exe
2848	Unicorn-5284.exe
3496	Unicorn-15498.exe
4220	Unicorn-3246.exe
3600	Unicorn-10645.exe
1528	Unicorn-11969.exe
4588	Unicorn-65062.exe
3436	Unicorn-56339.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 4732	2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe	82
PID 2712 wrote to memory of 4732	2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe	82
PID 2712 wrote to memory of 4732	2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe	82
PID 4732 wrote to memory of 3804	4732	Unicorn-62623.exe	83
PID 4732 wrote to memory of 3804	4732	Unicorn-62623.exe	83
PID 4732 wrote to memory of 3804	4732	Unicorn-62623.exe	83
PID 2712 wrote to memory of 4684	2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe	84
PID 2712 wrote to memory of 4684	2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe	84
PID 2712 wrote to memory of 4684	2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe	84
PID 3804 wrote to memory of 3692	3804	Unicorn-35571.exe	85
PID 3804 wrote to memory of 3692	3804	Unicorn-35571.exe	85
PID 3804 wrote to memory of 3692	3804	Unicorn-35571.exe	85
PID 4732 wrote to memory of 1772	4732	Unicorn-62623.exe	86
PID 4732 wrote to memory of 1772	4732	Unicorn-62623.exe	86
PID 4732 wrote to memory of 1772	4732	Unicorn-62623.exe	86
PID 4684 wrote to memory of 3268	4684	Unicorn-64906.exe	87
PID 4684 wrote to memory of 3268	4684	Unicorn-64906.exe	87
PID 4684 wrote to memory of 3268	4684	Unicorn-64906.exe	87
PID 2712 wrote to memory of 2408	2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe	88
PID 2712 wrote to memory of 2408	2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe	88
PID 2712 wrote to memory of 2408	2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe	88
PID 3692 wrote to memory of 368	3692	Unicorn-29863.exe	89
PID 3692 wrote to memory of 368	3692	Unicorn-29863.exe	89
PID 3692 wrote to memory of 368	3692	Unicorn-29863.exe	89
PID 3804 wrote to memory of 3232	3804	Unicorn-35571.exe	90
PID 3804 wrote to memory of 3232	3804	Unicorn-35571.exe	90
PID 3804 wrote to memory of 3232	3804	Unicorn-35571.exe	90
PID 3268 wrote to memory of 2116	3268	Unicorn-13526.exe	91
PID 3268 wrote to memory of 2116	3268	Unicorn-13526.exe	91
PID 3268 wrote to memory of 2116	3268	Unicorn-13526.exe	91
PID 4684 wrote to memory of 1404	4684	Unicorn-64906.exe	92
PID 4684 wrote to memory of 1404	4684	Unicorn-64906.exe	92
PID 4684 wrote to memory of 1404	4684	Unicorn-64906.exe	92
PID 2408 wrote to memory of 2992	2408	Unicorn-11480.exe	93
PID 2408 wrote to memory of 2992	2408	Unicorn-11480.exe	93
PID 2408 wrote to memory of 2992	2408	Unicorn-11480.exe	93
PID 2712 wrote to memory of 1204	2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe	94
PID 2712 wrote to memory of 1204	2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe	94
PID 2712 wrote to memory of 1204	2712	0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe	94
PID 1772 wrote to memory of 1604	1772	Unicorn-51030.exe	95
PID 1772 wrote to memory of 1604	1772	Unicorn-51030.exe	95
PID 1772 wrote to memory of 1604	1772	Unicorn-51030.exe	95
PID 4732 wrote to memory of 548	4732	Unicorn-62623.exe	96
PID 4732 wrote to memory of 548	4732	Unicorn-62623.exe	96
PID 4732 wrote to memory of 548	4732	Unicorn-62623.exe	96
PID 368 wrote to memory of 1840	368	Unicorn-61907.exe	101
PID 368 wrote to memory of 1840	368	Unicorn-61907.exe	101
PID 368 wrote to memory of 1840	368	Unicorn-61907.exe	101
PID 3692 wrote to memory of 3456	3692	Unicorn-29863.exe	102
PID 3692 wrote to memory of 3456	3692	Unicorn-29863.exe	102
PID 3692 wrote to memory of 3456	3692	Unicorn-29863.exe	102
PID 3232 wrote to memory of 2272	3232	Unicorn-33873.exe	103
PID 3232 wrote to memory of 2272	3232	Unicorn-33873.exe	103
PID 3232 wrote to memory of 2272	3232	Unicorn-33873.exe	103
PID 3804 wrote to memory of 4548	3804	Unicorn-35571.exe	104
PID 3804 wrote to memory of 4548	3804	Unicorn-35571.exe	104
PID 3804 wrote to memory of 4548	3804	Unicorn-35571.exe	104
PID 3268 wrote to memory of 4296	3268	Unicorn-13526.exe	105
PID 3268 wrote to memory of 4296	3268	Unicorn-13526.exe	105
PID 3268 wrote to memory of 4296	3268	Unicorn-13526.exe	105
PID 2116 wrote to memory of 1928	2116	Unicorn-4730.exe	106
PID 2116 wrote to memory of 1928	2116	Unicorn-4730.exe	106
PID 2116 wrote to memory of 1928	2116	Unicorn-4730.exe	106
PID 1404 wrote to memory of 4360	1404	Unicorn-8793.exe	107

C:\Users\Admin\AppData\Local\Temp\0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe
"C:\Users\Admin\AppData\Local\Temp\0d8d63f75700203abda9169189d67aa38a56ea00661775aff11b9710f0ee0c56N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35571.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61907.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39811.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        9⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
        10⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        10⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        10⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        9⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3972.exe
        9⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        9⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
        9⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        9⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
        8⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
        8⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65062.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        8⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28151.exe
        9⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe
        10⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42657.exe
        10⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
        10⤵
        
        PID:17432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3536.exe
        9⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        9⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63210.exe
        8⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        8⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35129.exe
        7⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 464
        8⤵
        Program crash
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
        7⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        7⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51106.exe
        7⤵
        
        PID:17384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62758.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56339.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
        8⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18285.exe
        9⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14926.exe
        10⤵
        
        PID:15516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
        9⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11205.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56002.exe
        8⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28383.exe
        9⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50905.exe
        8⤵
        
        PID:11928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2461.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe
        8⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25477.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45587.exe
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-413.exe
        8⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17976.exe
        8⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        8⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        7⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30692.exe
        7⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51975.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54191.exe
        8⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        9⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        9⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        9⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        8⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        8⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        8⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        7⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25170.exe
        7⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        7⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
        6⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57455.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        7⤵
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58769.exe
        6⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39737.exe
        6⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11238.exe
        6⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-750.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40963.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37751.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        9⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        9⤵
        
        PID:12864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        9⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        8⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        8⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        8⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
        8⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        7⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
        6⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51939.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        8⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36053.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60766.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
        7⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        7⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32022.exe
        6⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36421.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27641.exe
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51539.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51290.exe
        8⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        7⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        7⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        7⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15004.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        6⤵
        
        PID:13088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        6⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        5⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2774.exe
        6⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64471.exe
        7⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        8⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        7⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        7⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        7⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
        6⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63733.exe
        6⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15673.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        6⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32328.exe
        5⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10994.exe
        6⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
        7⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        6⤵
        
        PID:14632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        6⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
        5⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe
        5⤵
        
        PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10542.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42359.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49707.exe
        7⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45042.exe
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
        9⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        9⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59009.exe
        9⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        9⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23416.exe
        8⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        8⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
        8⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        8⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        8⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        7⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        7⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51106.exe
        7⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9421.exe
        6⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        8⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        8⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        8⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48410.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28255.exe
        8⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        8⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42249.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11425.exe
        7⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        7⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
        6⤵
        
        PID:9652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
        6⤵
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        6⤵
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43681.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54907.exe
        6⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50595.exe
        8⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49806.exe
        8⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        8⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28949.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        8⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31625.exe
        8⤵
        
        PID:17156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        7⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe
        7⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40957.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35603.exe
        7⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        7⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        7⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44029.exe
        6⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34776.exe
        6⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41377.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        7⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe
        6⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        6⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41083.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48974.exe
        6⤵
        
        PID:15976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44142.exe
        6⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10824.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39465.exe
        5⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27139.exe
        5⤵
        
        PID:16572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12580.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11798.exe
        6⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65151.exe
        8⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        8⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53646.exe
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        7⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        7⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53210.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
        7⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        7⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        7⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12124.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        6⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37049.exe
        5⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        7⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        7⤵
        
        PID:16424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10248.exe
        6⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
        6⤵
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41415.exe
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        6⤵
        
        PID:12956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        6⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7709.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        5⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14157.exe
        5⤵
        
        PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24819.exe
        5⤵
        
        PID:544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        6⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54487.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45338.exe
        7⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
        7⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
        6⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19651.exe
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53913.exe
        6⤵
        
        PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        5⤵
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exe
        5⤵
        
        PID:16980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19972.exe
      4⤵
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
        5⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16807.exe
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        6⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58817.exe
        6⤵
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62145.exe
        5⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
        6⤵
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        5⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        5⤵
        
        PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43333.exe
      4⤵
      PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-574.exe
        5⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4520.exe
        5⤵
        
        PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe
      4⤵
      PID:9464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64541.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-273.exe
      4⤵
      PID:16448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8238.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52307.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24399.exe
        8⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
        9⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        8⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        8⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59379.exe
        8⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36105.exe
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        7⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        7⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20146.exe
        7⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
        6⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        8⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13345.exe
        8⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        8⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18809.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
        7⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
        7⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11880.exe
        6⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
        7⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
        7⤵
        
        PID:17088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        6⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4155.exe
        6⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
        8⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        9⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33213.exe
        9⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        8⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62634.exe
        7⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60661.exe
        7⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        7⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55217.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63210.exe
        6⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        6⤵
        
        PID:12588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
        6⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4812.exe
        5⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54191.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57310.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        7⤵
        
        PID:16456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65426.exe
        6⤵
        
        PID:9940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        6⤵
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
        6⤵
        
        PID:16868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2510.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15865.exe
        6⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43667.exe
        5⤵
        
        PID:17032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12021.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47507.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17139.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35603.exe
        8⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        8⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        7⤵
        
        PID:16032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        6⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
        7⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        7⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        6⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
        6⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
        6⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
        6⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64693.exe
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
        5⤵
        
        PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5284.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64227.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18040.exe
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20141.exe
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44850.exe
        6⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
        5⤵
        
        PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16807.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        6⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
        5⤵
        
        PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
      4⤵
      PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51643.exe
      4⤵
      PID:6728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14360.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15358.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe
        6⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
        8⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        9⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        9⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        8⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe
        8⤵
        
        PID:18252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        7⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30012.exe
        7⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        7⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
        7⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37577.exe
        7⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5648.exe
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        6⤵
        
        PID:15184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exe
        6⤵
        
        PID:16628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48638.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        6⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        7⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17156.exe
        7⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48358.exe
        6⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
        6⤵
        
        PID:14256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
        6⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56805.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        6⤵
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45274.exe
        6⤵
        
        PID:664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        6⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25878.exe
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16504.exe
        5⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4155.exe
        5⤵
        
        PID:9376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2841.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1238.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55815.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23735.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
        7⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        7⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
        6⤵
        
        PID:14248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        6⤵
        
        PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54402.exe
        6⤵
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44142.exe
        6⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        5⤵
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe
        5⤵
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        5⤵
        
        PID:17412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4812.exe
      4⤵
      PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39967.exe
        5⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15865.exe
        6⤵
        
        PID:16944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        5⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        5⤵
        
        PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        5⤵
        
        PID:9884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5021.exe
      4⤵
      PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56273.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe
      4⤵
      PID:3476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15987.exe
        5⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        6⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
        7⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        6⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        5⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
        6⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48974.exe
        6⤵
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        6⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
        5⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43494.exe
        5⤵
        
        PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37257.exe
        5⤵
        
        PID:10296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
      4⤵
      PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        5⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        6⤵
        
        PID:17420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        5⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
        5⤵
        
        PID:10336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62145.exe
      4⤵
      PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43086.exe
      4⤵
      PID:12716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
      4⤵
      PID:16588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
        5⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        6⤵
        
        PID:16796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        5⤵
        
        PID:14668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
      4⤵
      PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34952.exe
      4⤵
      PID:11532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43494.exe
      4⤵
      PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe
    3⤵
    PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22007.exe
      4⤵
      PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe
      4⤵
      PID:11636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
      4⤵
      PID:1096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52667.exe
    3⤵
    PID:8480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
    3⤵
    PID:12384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-273.exe
    3⤵
    PID:5904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27071.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24797.exe
        6⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19355.exe
        8⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        8⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        8⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59073.exe
        7⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43494.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        7⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe
        6⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54191.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17295.exe
        8⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        8⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        8⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        7⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        7⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31382.exe
        7⤵
        
        PID:16956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe
        6⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
        6⤵
        
        PID:10952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        6⤵
        
        PID:13540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27153.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61767.exe
        6⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52603.exe
        8⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        8⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        8⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58934.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34952.exe
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14713.exe
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41342.exe
        7⤵
        
        PID:17980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        7⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        7⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
        6⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        6⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
        5⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39287.exe
        6⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        7⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        7⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42265.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        6⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41749.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43357.exe
        5⤵
        
        PID:15140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        5⤵
        
        PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38275.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        6⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24119.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        8⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        8⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        7⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
        7⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1918.exe
        7⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39577.exe
        7⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        7⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        6⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
        6⤵
        
        PID:16544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe
        5⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        7⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
        7⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        7⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6853.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        6⤵
        
        PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50418.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        6⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43881.exe
        5⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7369.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe
        5⤵
        
        PID:15512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47123.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1460.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48401.exe
        6⤵
        
        PID:13392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
        6⤵
        
        PID:17320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        5⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
        5⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27158.exe
        5⤵
        
        PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe
      4⤵
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
        5⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
        6⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47029.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18809.exe
        5⤵
        
        PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
        5⤵
        
        PID:16532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
      4⤵
      PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8794.exe
        5⤵
        
        PID:12228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47074.exe
        5⤵
        
        PID:18428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56126.exe
      4⤵
      PID:10772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
      4⤵
      PID:13084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
      4⤵
      PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30033.exe
        5⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60719.exe
        6⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1460.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9645.exe
        7⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        7⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        6⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27694.exe
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49583.exe
        6⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe
        7⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11781.exe
        7⤵
        
        PID:16808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        6⤵
        
        PID:12812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe
        5⤵
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        5⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41415.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        7⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        7⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48358.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57397.exe
        6⤵
        
        PID:12736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        6⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52622.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14200.exe
        5⤵
        
        PID:10912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45014.exe
        5⤵
        
        PID:12712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
        5⤵
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48777.exe
      4⤵
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
      4⤵
      PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58711.exe
        5⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37575.exe
        6⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3641.exe
        5⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30612.exe
        5⤵
        
        PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31628.exe
      4⤵
      PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
      4⤵
      PID:15120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
      4⤵
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58259.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9354.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24149.exe
        7⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
        7⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48410.exe
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        6⤵
        
        PID:12524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        6⤵
        
        PID:16968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45042.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
        6⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        6⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9401.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        5⤵
        
        PID:17064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21289.exe
      4⤵
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52743.exe
        5⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42775.exe
        7⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61735.exe
        7⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        6⤵
        
        PID:14712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        6⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34621.exe
        5⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63733.exe
        5⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        5⤵
        
        PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48917.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30611.exe
        5⤵
        
        PID:9456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        5⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        5⤵
        
        PID:8748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
      4⤵
      PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16493.exe
        5⤵
        
        PID:376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
      4⤵
      PID:13940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
      4⤵
      PID:5892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44679.exe
        5⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26785.exe
        5⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3536.exe
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        5⤵
        
        PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23033.exe
      4⤵
      PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe
        5⤵
        
        PID:14516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52031.exe
        5⤵
        
        PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
      4⤵
      PID:10860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61350.exe
      4⤵
      PID:13452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
      4⤵
      PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5904.exe
    3⤵
    PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        5⤵
        
        PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        5⤵
        
        PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
      4⤵
      PID:14808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
      4⤵
      PID:15460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
    3⤵
    PID:7316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
    3⤵
    PID:11496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
    3⤵
    PID:2080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44087.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        6⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54191.exe
        7⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        8⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
        8⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        8⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12333.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe
        7⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        7⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        6⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 408
        7⤵
        Program crash
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39586.exe
        6⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        6⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62234.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        6⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        5⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        5⤵
        
        PID:11848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2924.exe
        5⤵
        
        PID:15520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11969.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15987.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45691.exe
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        7⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        7⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64310.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
        6⤵
        
        PID:14944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        5⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62581.exe
        5⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34106.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
        5⤵
        
        PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53193.exe
      4⤵
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37331.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe
        6⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        5⤵
        
        PID:12872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        5⤵
        
        PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41918.exe
      4⤵
      PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52101.exe
      4⤵
      PID:13100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
      4⤵
      PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24273.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6858.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37715.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        7⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        7⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56526.exe
        6⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57397.exe
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe
        5⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        6⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        5⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
        5⤵
        
        PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9909.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36667.exe
        5⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        5⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        5⤵
        
        PID:15632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
      4⤵
      PID:8584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
      4⤵
      PID:12472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
      4⤵
      PID:6040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29980.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15707.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        6⤵
        
        PID:13008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        6⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        5⤵
        
        PID:832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35093.exe
      4⤵
      PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        5⤵
        
        PID:9284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe
        5⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
      4⤵
      PID:10784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61350.exe
      4⤵
      PID:12928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
      4⤵
      PID:16400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exe
    3⤵
    PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
      4⤵
      PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        5⤵
        
        PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
      4⤵
      PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
      4⤵
      PID:14532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
      4⤵
      PID:2788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49641.exe
    3⤵
    PID:7608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23209.exe
    3⤵
    PID:11656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52271.exe
    3⤵
    PID:16000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29945.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64471.exe
        6⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        7⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        7⤵
        
        PID:17000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        6⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2202.exe
        6⤵
        
        PID:18240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3240.exe
        5⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27179.exe
        6⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64938.exe
        5⤵
        
        PID:11856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1460.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44317.exe
        5⤵
        
        PID:13376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46445.exe
        5⤵
        
        PID:17132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64501.exe
      4⤵
      PID:7568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48410.exe
      4⤵
      PID:11588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
      4⤵
      PID:1348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14834.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
        5⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        6⤵
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18809.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe
        5⤵
        
        PID:13524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        5⤵
        
        PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe
      4⤵
      PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        5⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18612.exe
        6⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        5⤵
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
      4⤵
      PID:9772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48522.exe
      4⤵
      PID:14736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
      4⤵
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50697.exe
    3⤵
    PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15078.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
        5⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        5⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
      4⤵
      PID:9260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
      4⤵
      PID:14512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
    3⤵
    PID:7552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39745.exe
    3⤵
    PID:11712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
    3⤵
    PID:4848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35208.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35208.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11134.exe
      4⤵
      PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
        5⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62411.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        6⤵
        
        PID:16464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        5⤵
        
        PID:15072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59778.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51097.exe
      4⤵
      PID:11352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55746.exe
      4⤵
      PID:1448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
    3⤵
    PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
      4⤵
      PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
      4⤵
      PID:12860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
      4⤵
      PID:11184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
    3⤵
    PID:9552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
    3⤵
    PID:14332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48120.exe
    3⤵
    PID:8452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47891.exe
    3⤵
    PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28727.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        5⤵
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe
      4⤵
      PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
      4⤵
      PID:13444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
      4⤵
      PID:7152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
    3⤵
    PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
      4⤵
      PID:11976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15865.exe
      4⤵
      PID:16916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
    3⤵
    PID:2368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25170.exe
    3⤵
    PID:15252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42945.exe
    3⤵
    PID:2228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
  2⤵
  PID:5860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27243.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
      4⤵
      PID:9692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
    3⤵
    PID:12328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
    3⤵
    PID:15700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
    3⤵
    PID:16740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47664.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47664.exe
  2⤵
  PID:8600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
  2⤵
  PID:12392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe
  2⤵
  PID:7260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2120 -ip 2120
1⤵
PID:6180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 7440 -ip 7440
1⤵
PID:7964

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:11196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10542.exe

Filesize
468KB

MD5
8c1c7a0d97578548987f4a832e8a28f2

SHA1
0919ce63c710ec0b23a8d628498ece25d9abe3a1

SHA256
f9acb75ffc8c861ee46d08f56af8947b848add5cf0493097b63e4141b77b405f

SHA512
2aa604c38b21268d4ab74d53e182801474287003790963612db403dcc43edaaff6712edaddf176cd250cf00c8149fcd626ee7e8f398cbd19955d5194e03f7498

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe

Filesize
468KB

MD5
5ba0e6c45e21ef420a7f740ff5bbcc96

SHA1
0c9e4eedaee1b53a4eb789aa2744398182d295b7

SHA256
f6a4cceb870975ca921d6f158c4b2fa36cf6c6208926c3a02122b01f139c1fd4

SHA512
798f545cd362705b7a0de2bfa57ae6b2cfdfb7d78209624e53fcd55420a741e3108494150b1006372987fd2adfd1297d0d06396810745c86aa68ad72b5d90c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12021.exe

Filesize
468KB

MD5
a4efb564f13cffbc10406992ba09084a

SHA1
b33d7617ab10ff1b289ec9ec36f7d5fe9da9712c

SHA256
c2b99047f6f80a0d33894e18f9d4b79cd714fb38f3be0528500a1e44e65833aa

SHA512
a035ab0da2792b6480a7bec067dccf7667da3d8b49133ed1e74ba3d4e6587b26757021b0b4a2b535afc954c42a30af82877e840d4b7aefd5e3bc1603d55a5dbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12580.exe

Filesize
468KB

MD5
afe9da186b9f80fccb66adf321d720ac

SHA1
4ebe3c2a4be801bfe4fc2ab51bf6d07d4191311d

SHA256
9cceae18553548e7b803cbe34003c712c3944e7a714de972291dda459a768d48

SHA512
1066970b95afe6e5e6c97c7831b6225dfb19224e3a018ae7bc17510ab1b26b135a639893a680151b781923b9216948857118e83b8860e57b1516a45d22f46cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe

Filesize
468KB

MD5
0efb74a307ddf8541f643d768d59bdbb

SHA1
9e439fc81ca5dfa9542fd73110e7bf36366d38b8

SHA256
82d414251c0defeccf3dede651a065c329c221ba97ca55b43a33a6789f64cb2e

SHA512
dc9a178c999305e0428f21066c3ee2157f39b1465a22fe24dcbfab286c2607e26c73b4edaaeb304e3e6a8bb3182a09671b8f372ff03465aa1fce912041f98561

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe

Filesize
468KB

MD5
c0a5de8c8fc39d2f4d0c4ea64f663bc5

SHA1
00593e0218f73e380edb27429f9e040ac1f8f437

SHA256
db5b48f8622a7a2057a7a91a21899e72182a96ee3e992ba0034301149c567107

SHA512
d090aee6ebacc741a7b2ea5eff27afb7a74f14f4b867581dd94c75080d40c810d5a546c874875c28c70357820f5c631f34ec68bf6a7fe234e2cf958c27eb3749

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14360.exe

Filesize
468KB

MD5
61ed7a765842f81ff4dc4b342f0af9dd

SHA1
a8a7dd00273b18ff2d1af041dbff5848af014822

SHA256
67c56ed1672f6d5dfa79ddd8f1733ee5ca6594cb6cf5433b787ffdd876208795

SHA512
aaf3ce56b71c373d990739277b08a12c08adf2767a2b4f8f39169444c4b17246a73da3491177f998909f97b76369953725cc71830198ab70f79590a0f7ff92fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15358.exe

Filesize
468KB

MD5
d0d9a24e3758227374de09ceeccf8de3

SHA1
1de7686560ca955be43b7738966ee543f10aec3f

SHA256
d7d1e79ec3730d00de3d7277bbec81e72dc8c42f39db9af8f5f2c7fab8c31d57

SHA512
3f6470b4b8cedbf1f66a6b978128fab37a2ad0d4d8192dc186e1740fb1afba26ccc30536b83f949c7110e82bc4b5633755360b61585cf11a4b28b27f9ff33f87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24273.exe

Filesize
468KB

MD5
5c6f9e2ef04e4d981a51f130149e2dde

SHA1
0299ddc2a2c59355a179363287a101fedb0abc41

SHA256
6ebe719fe3b9ea317b6c61d186a4893ddb817c252cba03d067687a7176ee78c4

SHA512
9faca3666a19b6f3c86d0d51b3f7fae90f0b00b0b4b75dbb6b132b4d9ad46625cca50f24068431b914f871dae6ae61002adf0e9fe7c35446c95d815ec795b1f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe

Filesize
468KB

MD5
495d8e83aee5425e25c054f1df7ba6c2

SHA1
86caa59c2107062f0cc397ecfbb01bbf80cba79a

SHA256
8cced180d223fc2be7461f302526004e5ec2151c8ef7d8130d288eb2a2ba8de7

SHA512
989b0543faa4a476df19cc81b5f3b51e39fe691c2705647840e1b9413040ebc8806724940d983dd3294cdc199f97c56369c24055fb38e602c4a4e6abc27fa8a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27071.exe

Filesize
468KB

MD5
666f61b420ddc3b556a8053d7fbcf9b2

SHA1
266dd1fe3138213d465b9632bfb84ccb2184be97

SHA256
3b7213e5802e1f1b10a5261638bab55b34356f53dfd80c757e29602b5c442211

SHA512
4099828e4b2d0bb24c0bee0d17be574a69092d3747346d50fee0542a8e4c26e211260bbd116a4568d746b3216300cd2850613aab9a6eb53dde520ed8f1897989

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe

Filesize
468KB

MD5
1bd5a59db272792c5611a8d9eae1b5b1

SHA1
da3e46ae6b2d8fef127f70b4f8a717d0576c0996

SHA256
4e337a445cdabf8e2887dadbc4fdbc241ddd90752be47e568060256c6abef1d8

SHA512
b60659ac87f46eb73402ef91a0a85e3b82b511de88508d4c00708fa033006f0041c3da802442ad584fe53515b95264b4034525ce32fac38a9a6193f2bd94857d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe

Filesize
468KB

MD5
b48a20d7ea1f2790e235fc757419278d

SHA1
5b84b03bc600a28f3e476c26a607b068564a1dec

SHA256
5e7b98bce1b46a7e5117bf3dd9c4df59f0f15db8fe14050613b55c5fc0b9b487

SHA512
94f18d096b7ce55764ff9a03c7c259feaf88c2ca099a5854ee3ccfd0f0a67149b5284cbf1fa8d7093a5c1254ac8319e90bfecd46177817c8abbd787a46b3a9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe

Filesize
468KB

MD5
00b4749fa08611dc7b4ef24db2006235

SHA1
f365043ef44619add29b39ae69a2005399660f84

SHA256
2a7b74ff4a0cb6e2e301f0c5e5e14cff51689887091cbe99aca14ea8f7698a7e

SHA512
b8b19669f705735655ba74f22b57b1ad5bb639805cdf5c9f37e7ecf02895c24c7b9928f91ae11eaa5f0c8fc0256b1e4856faf8ab9a3a0ab3fc26b91479e09c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe

Filesize
468KB

MD5
910913c13dccced3282ab178a27f1738

SHA1
03b1cebc8a5f4cbd687b62f9acbbf4564f19fe43

SHA256
f2cc4efdb3f84907b37d62fee37bb607226e11aec1b051b8d32cb8e246b25e1a

SHA512
b620d2a0047039ec75f0a94689b34693f4c870cf93da19b3f99a25650704f3f5811d5f3937322a08c6e2d9bae90c32193b26f868e85828606ce1c1eeeb65f17c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35208.exe

Filesize
468KB

MD5
11a51bcba2e7e72374985d033e8ced1c

SHA1
acc67007a2b2666cb94b018416b9e2a4d8bbf18d

SHA256
5dc3d642b8e4ea8591f2004ef11f0546ecb0946f2200728309b32894b67e6db1

SHA512
1136ae641a0b372f8d864ffc9d2a218db35d2c563437ec77d8049ef0f692a9c74899e6c833c1ddc08a962925d80a4d8f5c9fe6fd1c3a448cb85132a1303c2c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35571.exe

Filesize
468KB

MD5
c2e105eb139ef443c986100e026dae5a

SHA1
05a8fe4386cdc6a7e9faa3f44747f8b3d7758167

SHA256
e866e9d3d763af58eb46d39cbef73860bd8cf2ca0f45b5f1553609c813611d38

SHA512
7940506368a8c8a2c0610ae73cd223c4dc1e5f670c0b65c1547f29738602266bd784acbf4576221198fa16507edcbadac47ed1082abca0499609e8251ac5508c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe

Filesize
468KB

MD5
561f6d2a51f79807c0bc8489bc87c5dd

SHA1
430a985e620b2029a671bf6c30829f06262cff52

SHA256
381de6482a545cd3d52f061c927a5c1d4f31892fe67dace7bee99338c5c3e831

SHA512
cb0a8b9d776b0282fac4ad92c4b4ca9dee4cdfa88aa1b3d9e87d513eb044bc267fc9c3e52cc4574f153b927fd0c525c4ad0f6c1762ca0ea7a81b45f4f85fef78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe

Filesize
468KB

MD5
7e95477aad42f5a6c47b8e04df6e2da6

SHA1
f23097146975369e5b8e9a0d41bc70e698d3f697

SHA256
05f681ba330dcda8d51bbed167b29cfa4eb5481d9ca7c8461282c2dca6bd94fd

SHA512
08e344e13a85066d0d672f38ce3b6ca457eaa6e8ebfbcf0c6a5cc1335d14dc40b1f113049d750723c239aba811199644279eb2779091bd9949c6890ec1a84f28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe

Filesize
468KB

MD5
b2d5764522631ba28f5551927adb62a1

SHA1
4a353b3d36531a09f9f0641569b60fd31ba8e363

SHA256
1c9426b4f2e08f22ca4fd18d15c199f682acb9129419e70933843fbd15c199f8

SHA512
96eeb9139bec681f8eac1c687feb49af286f777f4db351ba517dc853f2f022d6019e1ac24389bbb85a9c97248c9977a66c2c931706b10feddb6941f81c143d95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe

Filesize
468KB

MD5
dadb8a25964b299a8971f8f52dd1be10

SHA1
20f1e9910481d2489c8aa19870a0270fc413ed6b

SHA256
7166186b90d0fcc1863c32f9f044e5996bd433163eae6e3ae0cad6b195dc00f6

SHA512
e5508ee036ade36b35c33e35ebdd8c98fdfcdfca4e3e4fc0ccb6ebf789d378d504f6e22c777abbe1710972125df533d4072a900766db092c851df1e39c360b41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe

Filesize
468KB

MD5
47358da3346e705a99c7163f66421016

SHA1
52db71d3257dbb4a5ca69afccab8472819fe8941

SHA256
a04bcb06b169a6698106d9db8ea63df07e13564fd1ac347486439051ed481a68

SHA512
eee6d9a85a3a72d1a914342aed75bf429a5b016d570f7b67e17a5f3ccc6874e88b2c2dbb37b37bb4742a1327673546cde5d3a06c5bad36bcf7df825607031628

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51030.exe

Filesize
468KB

MD5
89f73dbd41d777cd8f28962eeb17d1d9

SHA1
c7b05241ce127502047ffc23ca109eaa85c1d0bc

SHA256
8a337dd7e6add267c08e43dc750faf06884170e1a0b9fc66ff21648f6c32bff6

SHA512
b34457531543a0b4f896cea96971c2ba55782f93b611a914d847c1b31d532fdaa048554ebdcff52af097bf20c2c4eee7594dc5502049c0b96ff7f5f4984b97bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52307.exe

Filesize
468KB

MD5
c153c77065f38503be97665f78380ee1

SHA1
50b07ee49c0ae5ae9d19a34b446f57ab9920b1b9

SHA256
539363fabe99b7551b1a2ed5a364024d1243922e025c76cb44c67e1c00939103

SHA512
dd4a12a49598c55df736314a371fd831076d1795d7e1ae9d4583aa3b7fdf3553d81d9815bd03ddd69691cbc6588595f4639afc9d2b75b0fa021e0afbfa2b03e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe

Filesize
468KB

MD5
d6c1ef01a06ccb4a221f13d5b922393c

SHA1
e613d3a0e52ef1be93ba347161201a8df15bef08

SHA256
44613287ece1f7330f3b271518e4cb464cd8073f8f8466b0d8bae6bd37a38f5e

SHA512
bd8809389cdbed685428a776a39be92081975e02e86cba79ac602b6edfe130afc362ddec32068e6f36b9c6d7fa3154b70ef2d9bcf8ee52809a559ebcb5a960b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61907.exe

Filesize
468KB

MD5
5081265c02decf84baffe385552ba17a

SHA1
852258db39d3a44a8a781b2417516a7f67aa0593

SHA256
36670bb559358a0055d6fab83d346dc55b234eff9f522e67f52ae20e236b628a

SHA512
1c3372f4565c4993e605179f5252b3bd49a0cc9decb3ede15e2450a6526987c126e9fd76eb65fbf01e6ec65f35bceacbb99882f8c080c7c23c519cbdcf496991

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe

Filesize
468KB

MD5
7c1dc45b18544b2e96f58f84a536c234

SHA1
2ac6d4a3faa011862d9174e3458f061a8f2ed860

SHA256
85e59af3364d1bc5bb44641cc36f5f4dc6f392d52bb3c1696c70e2f6c2f05305

SHA512
5613ede07d4981eef81211b873cd5353d285ac546ad7d2ea8c47cdf9cbdecc9872c83ac6cbb76c376a9ca09f3ae0ad47fb17a6eed1dc767e436fc72445bcb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe

Filesize
468KB

MD5
4df53250fa4a0bcad263df0695cba080

SHA1
3f541f8b1ec6d42a7a3092ec8f6d7f3d8cf0d584

SHA256
90456a7be06d95feeeaa93dab8f744e5f159ef8c68557f2e5a1b9ad72b343ce8

SHA512
19d81abcbda9509d237ca0955710fe980b2e2f6dce26cee5b11cc8f4341c02b63d289ed00a0aa0dcfd541a592dd7faac112ce05d2464d77f06250947af8913f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7205.exe

Filesize
468KB

MD5
2028ea334de1b16d178b64c600cf76e8

SHA1
f472d523bf0fb3de0d3b898aa5829ef198846d9d

SHA256
b438729ec6c6f66ad5274e5929fbce90d81e99d8480ae10f92d5586f8e723d3e

SHA512
ffb5326dbce985cbb69e42b453ac79a982bbb06f0d9a90569eb3b937812b7ac5639a338b11bf6d466b033d1961ce82dbe2d35de4fac002b011efad144ca2b3de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe

Filesize
468KB

MD5
eb4936a9ca9e73693f30e5f0385bbca2

SHA1
bf57a1590fc85fd71f65427c6fb0a60e831ab414

SHA256
916da5a0f59086b99b5d70b712f87356b1978d4b6b7a34b6923908bdc2420f09

SHA512
818a91b5ae347947dd404ab18f3d83c9c53e0d31eb753b31d24d168aef65d092469cf12f77d163d6dd9bb244fb784a7f2e289e085cbeb2559144cfdbbcd3b24f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8238.exe

Filesize
468KB

MD5
b4ace09b3a7f86254683b5a535d99572

SHA1
f4dc1fb83bf44f2e8a51d64a7806bb627fcb6eeb

SHA256
7b1f619469fe3604a90702c0b2395e6007d4f265eda2d68e06938dd9ff4c510a

SHA512
e8fcbe988530c48951a68200fbe797b32a086608d85c030c08f682ecf7132468dc209b1b54000ec99741972761ae470feaed49aa08704d5072961d46d818d1f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe

Filesize
468KB

MD5
c52289ffa0dcee19a235d21773a90df4

SHA1
42da9c4fd611d39a5ed89816e24a5779f395dbea

SHA256
9ee4e95fd384200ad7e69f487a2346fe398a298b447e3d89c1f5cbd70b9aeb38

SHA512
b68776e6a3b5554278a2eeb4b11e5a4c3f2ba41fe9f3b3671ecb01d44f8c49613b4d75c954274ea06b7b2e3dd12d2c29acaa9645f4841e4abc81fc8ccc9c883e

Download Submit
memory/244-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/368-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/544-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/548-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/756-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1000-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1008-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1204-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1340-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1404-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1416-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1752-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2116-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2272-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2496-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2676-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3148-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3180-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3228-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3268-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3404-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3436-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3496-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3552-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3592-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3632-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3652-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3692-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3772-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3788-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3796-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3804-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3972-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4052-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4084-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4108-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4220-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4384-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4448-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4684-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4736-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5236-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5260-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5504-567-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5516-570-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads