0d3bece7e9f475b4f38c33277d70b2398113ceb3468dd9f5668076831474cdb1

Analysis

max time kernel
118s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14481dd045d9b89956551731f6f2daf0N.exe
Size

468KB
MD5

14481dd045d9b89956551731f6f2daf0
SHA1

ce6b9498bda15017f4ec17e468641703cf2c456b
SHA256

0d3bece7e9f475b4f38c33277d70b2398113ceb3468dd9f5668076831474cdb1
SHA512

8aaa73030f8dfef5ca7ccf8fd97c5d4066ea50d3d07997001a85c0bf4c7c6e7ba1a75ead8199e2f9ae3cf19751fb5b3bbab1197e1ed99053040718c2f7065736
SSDEEP

3072:ibAoogydId5BybY5Pztj+fi/5qjMJ3pStmHeLV4toeVt9iluwflF:ibbombByiPJj+fUZOOoezAluw

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2644	Unicorn-12436.exe
2408	Unicorn-51689.exe
2024	Unicorn-47968.exe
2548	Unicorn-30605.exe
1544	Unicorn-30605.exe
5096	Unicorn-65123.exe
1532	Unicorn-51388.exe
1468	Unicorn-11720.exe
1568	Unicorn-36417.exe
1472	Unicorn-36971.exe
548	Unicorn-48669.exe
1500	Unicorn-56135.exe
4412	Unicorn-812.exe
2128	Unicorn-12799.exe
840	Unicorn-28470.exe
4408	Unicorn-28545.exe
4384	Unicorn-16847.exe
4828	Unicorn-36521.exe
2956	Unicorn-40605.exe
5048	Unicorn-64917.exe
3892	Unicorn-56749.exe
1132	Unicorn-35374.exe
3668	Unicorn-23620.exe
4820	Unicorn-4019.exe
2512	Unicorn-38175.exe
4668	Unicorn-24439.exe
3916	Unicorn-24439.exe
972	Unicorn-25997.exe
1892	Unicorn-37984.exe
4768	Unicorn-26573.exe
2908	Unicorn-57007.exe
4612	Unicorn-47356.exe
2400	Unicorn-47953.exe
2364	Unicorn-55545.exe
3100	Unicorn-19343.exe
4676	Unicorn-48685.exe
3980	Unicorn-28819.exe
928	Unicorn-52577.exe
4396	Unicorn-64829.exe
1076	Unicorn-64829.exe
4600	Unicorn-19905.exe
3484	Unicorn-3184.exe
4432	Unicorn-48856.exe
2616	Unicorn-40687.exe
2012	Unicorn-19713.exe
4556	Unicorn-18559.exe
4808	Unicorn-54231.exe
3804	Unicorn-60096.exe
1156	Unicorn-24159.exe
2540	Unicorn-11352.exe
3400	Unicorn-9306.exe
2912	Unicorn-6506.exe
4872	Unicorn-33810.exe
3620	Unicorn-33671.exe
4784	Unicorn-53537.exe
4380	Unicorn-36438.exe
1064	Unicorn-1906.exe
1496	Unicorn-44793.exe
1504	Unicorn-16759.exe
2276	Unicorn-50221.exe
1484	Unicorn-50221.exe
4028	Unicorn-21367.exe
1008	Unicorn-15502.exe
3592	Unicorn-8996.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3044	4408	WerFault.exe	109
9664	4632	WerFault.exe	222
10356	1640	WerFault.exe	276
16112	6580	WerFault.exe	281

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48934.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4892	dwm.exe
Token: SeChangeNotifyPrivilege	4892	dwm.exe
Token: 33	4892	dwm.exe
Token: SeIncBasePriorityPrivilege	4892	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2328	14481dd045d9b89956551731f6f2daf0N.exe
2644	Unicorn-12436.exe
2024	Unicorn-47968.exe
2408	Unicorn-51689.exe
1544	Unicorn-30605.exe
2548	Unicorn-30605.exe
1532	Unicorn-51388.exe
5096	Unicorn-65123.exe
1468	Unicorn-11720.exe
1568	Unicorn-36417.exe
1500	Unicorn-56135.exe
4412	Unicorn-812.exe
1472	Unicorn-36971.exe
548	Unicorn-48669.exe
2128	Unicorn-12799.exe
840	Unicorn-28470.exe
4384	Unicorn-16847.exe
4828	Unicorn-36521.exe
5048	Unicorn-64917.exe
2956	Unicorn-40605.exe
3916	Unicorn-24439.exe
3892	Unicorn-56749.exe
4668	Unicorn-24439.exe
3668	Unicorn-23620.exe
2512	Unicorn-38175.exe
1132	Unicorn-35374.exe
4820	Unicorn-4019.exe
972	Unicorn-25997.exe
1892	Unicorn-37984.exe
4768	Unicorn-26573.exe
4612	Unicorn-47356.exe
2908	Unicorn-57007.exe
2400	Unicorn-47953.exe
2364	Unicorn-55545.exe
3100	Unicorn-19343.exe
3980	Unicorn-28819.exe
4676	Unicorn-48685.exe
928	Unicorn-52577.exe
4396	Unicorn-64829.exe
1076	Unicorn-64829.exe
4600	Unicorn-19905.exe
3484	Unicorn-3184.exe
4432	Unicorn-48856.exe
4556	Unicorn-18559.exe
2616	Unicorn-40687.exe
2012	Unicorn-19713.exe
4784	Unicorn-53537.exe
2912	Unicorn-6506.exe
3804	Unicorn-60096.exe
3620	Unicorn-33671.exe
1156	Unicorn-24159.exe
4808	Unicorn-54231.exe
4380	Unicorn-36438.exe
3400	Unicorn-9306.exe
2540	Unicorn-11352.exe
4872	Unicorn-33810.exe
1064	Unicorn-1906.exe
1496	Unicorn-44793.exe
1008	Unicorn-15502.exe
4028	Unicorn-21367.exe
2276	Unicorn-50221.exe
1504	Unicorn-16759.exe
1484	Unicorn-50221.exe
3592	Unicorn-8996.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2644	2328	14481dd045d9b89956551731f6f2daf0N.exe	87
PID 2328 wrote to memory of 2644	2328	14481dd045d9b89956551731f6f2daf0N.exe	87
PID 2328 wrote to memory of 2644	2328	14481dd045d9b89956551731f6f2daf0N.exe	87
PID 2644 wrote to memory of 2408	2644	Unicorn-12436.exe	92
PID 2644 wrote to memory of 2408	2644	Unicorn-12436.exe	92
PID 2644 wrote to memory of 2408	2644	Unicorn-12436.exe	92
PID 2328 wrote to memory of 2024	2328	14481dd045d9b89956551731f6f2daf0N.exe	93
PID 2328 wrote to memory of 2024	2328	14481dd045d9b89956551731f6f2daf0N.exe	93
PID 2328 wrote to memory of 2024	2328	14481dd045d9b89956551731f6f2daf0N.exe	93
PID 2408 wrote to memory of 2548	2408	Unicorn-51689.exe	96
PID 2408 wrote to memory of 2548	2408	Unicorn-51689.exe	96
PID 2408 wrote to memory of 2548	2408	Unicorn-51689.exe	96
PID 2024 wrote to memory of 1544	2024	Unicorn-47968.exe	95
PID 2024 wrote to memory of 1544	2024	Unicorn-47968.exe	95
PID 2024 wrote to memory of 1544	2024	Unicorn-47968.exe	95
PID 2328 wrote to memory of 5096	2328	14481dd045d9b89956551731f6f2daf0N.exe	97
PID 2328 wrote to memory of 5096	2328	14481dd045d9b89956551731f6f2daf0N.exe	97
PID 2328 wrote to memory of 5096	2328	14481dd045d9b89956551731f6f2daf0N.exe	97
PID 2644 wrote to memory of 1532	2644	Unicorn-12436.exe	98
PID 2644 wrote to memory of 1532	2644	Unicorn-12436.exe	98
PID 2644 wrote to memory of 1532	2644	Unicorn-12436.exe	98
PID 1544 wrote to memory of 1468	1544	Unicorn-30605.exe	101
PID 1544 wrote to memory of 1468	1544	Unicorn-30605.exe	101
PID 1544 wrote to memory of 1468	1544	Unicorn-30605.exe	101
PID 2548 wrote to memory of 1568	2548	Unicorn-30605.exe	102
PID 2548 wrote to memory of 1568	2548	Unicorn-30605.exe	102
PID 2548 wrote to memory of 1568	2548	Unicorn-30605.exe	102
PID 2024 wrote to memory of 1472	2024	Unicorn-47968.exe	103
PID 2024 wrote to memory of 1472	2024	Unicorn-47968.exe	103
PID 2024 wrote to memory of 1472	2024	Unicorn-47968.exe	103
PID 1532 wrote to memory of 548	1532	Unicorn-51388.exe	104
PID 1532 wrote to memory of 548	1532	Unicorn-51388.exe	104
PID 1532 wrote to memory of 548	1532	Unicorn-51388.exe	104
PID 2644 wrote to memory of 1500	2644	Unicorn-12436.exe	105
PID 2644 wrote to memory of 1500	2644	Unicorn-12436.exe	105
PID 2644 wrote to memory of 1500	2644	Unicorn-12436.exe	105
PID 5096 wrote to memory of 4412	5096	Unicorn-65123.exe	106
PID 5096 wrote to memory of 4412	5096	Unicorn-65123.exe	106
PID 5096 wrote to memory of 4412	5096	Unicorn-65123.exe	106
PID 2328 wrote to memory of 2128	2328	14481dd045d9b89956551731f6f2daf0N.exe	107
PID 2328 wrote to memory of 2128	2328	14481dd045d9b89956551731f6f2daf0N.exe	107
PID 2328 wrote to memory of 2128	2328	14481dd045d9b89956551731f6f2daf0N.exe	107
PID 2408 wrote to memory of 840	2408	Unicorn-51689.exe	108
PID 2408 wrote to memory of 840	2408	Unicorn-51689.exe	108
PID 2408 wrote to memory of 840	2408	Unicorn-51689.exe	108
PID 1568 wrote to memory of 4408	1568	Unicorn-36417.exe	109
PID 1568 wrote to memory of 4408	1568	Unicorn-36417.exe	109
PID 1568 wrote to memory of 4408	1568	Unicorn-36417.exe	109
PID 2548 wrote to memory of 4384	2548	Unicorn-30605.exe	110
PID 2548 wrote to memory of 4384	2548	Unicorn-30605.exe	110
PID 2548 wrote to memory of 4384	2548	Unicorn-30605.exe	110
PID 2128 wrote to memory of 4828	2128	Unicorn-12799.exe	113
PID 2128 wrote to memory of 4828	2128	Unicorn-12799.exe	113
PID 2128 wrote to memory of 4828	2128	Unicorn-12799.exe	113
PID 1468 wrote to memory of 2956	1468	Unicorn-11720.exe	115
PID 1468 wrote to memory of 2956	1468	Unicorn-11720.exe	115
PID 1468 wrote to memory of 2956	1468	Unicorn-11720.exe	115
PID 1472 wrote to memory of 5048	1472	Unicorn-36971.exe	116
PID 1472 wrote to memory of 5048	1472	Unicorn-36971.exe	116
PID 1472 wrote to memory of 5048	1472	Unicorn-36971.exe	116
PID 4412 wrote to memory of 3892	4412	Unicorn-812.exe	117
PID 4412 wrote to memory of 3892	4412	Unicorn-812.exe	117
PID 4412 wrote to memory of 3892	4412	Unicorn-812.exe	117
PID 2328 wrote to memory of 1132	2328	14481dd045d9b89956551731f6f2daf0N.exe	118

C:\Users\Admin\AppData\Local\Temp\14481dd045d9b89956551731f6f2daf0N.exe
"C:\Users\Admin\AppData\Local\Temp\14481dd045d9b89956551731f6f2daf0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12436.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12436.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
        6⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 464
        7⤵
        Program crash
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40687.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15925.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        9⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        9⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
        9⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
        8⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe
        8⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24236.exe
        8⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16069.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe
        8⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55637.exe
        9⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36654.exe
        9⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
        8⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        8⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        8⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19846.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        7⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        7⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        7⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        7⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        7⤵
        
        PID:16076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
        6⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10032.exe
        7⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10562.exe
        7⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16575.exe
        6⤵
        
        PID:14952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
        6⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44793.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7875.exe
        8⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        9⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29802.exe
        9⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        9⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19654.exe
        8⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
        8⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53200.exe
        8⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13199.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13184.exe
        8⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58436.exe
        8⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        8⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26672.exe
        7⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
        7⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59915.exe
        7⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16759.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        8⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        8⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
        8⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
        8⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
        8⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        7⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52379.exe
        7⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        7⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        7⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
        6⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        7⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        7⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30814.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        7⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48908.exe
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46647.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        6⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41488.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        7⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46101.exe
        8⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
        9⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
        9⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61054.exe
        9⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe
        8⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        8⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23198.exe
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe
        8⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
        8⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exe
        8⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54168.exe
        7⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        7⤵
        
        PID:16316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34927.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        7⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43043.exe
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        6⤵
        
        PID:11792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61891.exe
        6⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-686.exe
        6⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21367.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52909.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40432.exe
        7⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
        7⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19322.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62196.exe
        6⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        6⤵
        
        PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45863.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        7⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
        7⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        6⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        6⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        5⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        6⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40890.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8706.exe
        5⤵
        
        PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28997.exe
        8⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 692
        9⤵
        Program crash
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16199.exe
        8⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30370.exe
        8⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56903.exe
        8⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2778.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55063.exe
        7⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50967.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        7⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
        7⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58617.exe
        7⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39656.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
        6⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24455.exe
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40432.exe
        7⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63770.exe
        7⤵
        
        PID:16056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-631.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        6⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        6⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        6⤵
        
        PID:13392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        6⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48908.exe
        5⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1530.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49631.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38172.exe
        5⤵
        
        PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37984.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53537.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56713.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        8⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        8⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
        8⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45756.exe
        7⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35835.exe
        6⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22417.exe
        7⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        7⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        7⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8576.exe
        6⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        6⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe
        6⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49675.exe
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe
        5⤵
        
        PID:14548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        5⤵
        
        PID:15972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        7⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        7⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11731.exe
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
        6⤵
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        6⤵
        
        PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        5⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39744.exe
        5⤵
        
        PID:12120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42081.exe
        5⤵
        
        PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28403.exe
      4⤵
      PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        5⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10652.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        6⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6898.exe
        6⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        5⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        5⤵
        
        PID:15976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48173.exe
      4⤵
      PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30837.exe
        5⤵
        
        PID:13680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36846.exe
        5⤵
        
        PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
      4⤵
      PID:11036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
      4⤵
      PID:14788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52594.exe
      4⤵
      PID:6940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61077.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15016.exe
        8⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        8⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        8⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        7⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
        7⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
        6⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        7⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47682.exe
        7⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52379.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        6⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53604.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
        7⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        7⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
        6⤵
        
        PID:14376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        6⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47643.exe
        5⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13199.exe
        5⤵
        
        PID:10996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        5⤵
        
        PID:13888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31368.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4019.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
        6⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60221.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22941.exe
        8⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
        8⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
        8⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8579.exe
        8⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        8⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        7⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22621.exe
        7⤵
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22239.exe
        6⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46568.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
        7⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8579.exe
        7⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        6⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12290.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        6⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11409.exe
        6⤵
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe
        5⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        5⤵
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55828.exe
        5⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58249.exe
        5⤵
        
        PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11789.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        7⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        7⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13058.exe
        6⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        5⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19322.exe
        5⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35721.exe
        5⤵
        
        PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37460.exe
      4⤵
      PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        5⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        6⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        6⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        5⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65191.exe
        5⤵
        
        PID:10072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22178.exe
      4⤵
      PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47173.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
        5⤵
        
        PID:7976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
      4⤵
      PID:10720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
      4⤵
      PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
      4⤵
      PID:16084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
      4⤵
      PID:8900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56135.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3791.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        7⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13270.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63516.exe
        5⤵
        
        PID:4632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 632
        6⤵
        Program crash
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe
        5⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        6⤵
        
        PID:16236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26478.exe
        5⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
        5⤵
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15502.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40465.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        6⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        7⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        7⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
        6⤵
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
        5⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30881.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe
        6⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        6⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52379.exe
        5⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        5⤵
        
        PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13270.exe
        5⤵
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
      4⤵
      PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
        5⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45297.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
        6⤵
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6425.exe
        6⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7403.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        5⤵
        
        PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1758.exe
      4⤵
      PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe
        5⤵
        
        PID:13216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35398.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
      4⤵
      PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45166.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30190.exe
      4⤵
      PID:8160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52577.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        5⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18613.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58007.exe
        7⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        7⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9655.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6634.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exe
        6⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        6⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        5⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9193.exe
        6⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33444.exe
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36482.exe
        5⤵
        
        PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
      4⤵
      PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9626.exe
        6⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-847.exe
        6⤵
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        6⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
        5⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6442.exe
        5⤵
        
        PID:12572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        5⤵
        
        PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15208.exe
        5⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        5⤵
        
        PID:12396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
        5⤵
        
        PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
      4⤵
      PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
      4⤵
      PID:10008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47198.exe
      4⤵
      PID:15960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3236.exe
        5⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
        6⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8579.exe
        6⤵
        
        PID:16372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe
        5⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        5⤵
        
        PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
      4⤵
      PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48405.exe
        5⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        5⤵
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe
        5⤵
        
        PID:15700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19114.exe
      4⤵
      PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
      4⤵
      PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22375.exe
      4⤵
      PID:11512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2939.exe
    3⤵
    PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
      4⤵
      PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34899.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe
        5⤵
        
        PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
      4⤵
      PID:9692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe
      4⤵
      PID:13484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
      4⤵
      PID:8200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
    3⤵
    PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
      4⤵
      PID:12904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8132.exe
      4⤵
      PID:704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61058.exe
    3⤵
    PID:10828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41803.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
    3⤵
    PID:6528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40605.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48685.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54497.exe
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        8⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        9⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        9⤵
        
        PID:13376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20153.exe
        9⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
        8⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20562.exe
        8⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        8⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65462.exe
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exe
        8⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        8⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        8⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        7⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42266.exe
        7⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37511.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41057.exe
        7⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        8⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        7⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11075.exe
        7⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
        7⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4751.exe
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55828.exe
        6⤵
        
        PID:16056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        6⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48856.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15769.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63537.exe
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        8⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43577.exe
        9⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53923.exe
        8⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63770.exe
        8⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33775.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43202.exe
        7⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13495.exe
        6⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29857.exe
        7⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33444.exe
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
        6⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17230.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        7⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe
        7⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35206.exe
        7⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3518.exe
        6⤵
        
        PID:14312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
        6⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55540.exe
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39875.exe
        5⤵
        
        PID:10596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
        5⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5691.exe
        5⤵
        
        PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64829.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
        6⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46049.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exe
        8⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
        9⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        8⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        8⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        8⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30075.exe
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
        7⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36680.exe
        7⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35425.exe
        7⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43479.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9193.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        6⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23162.exe
        6⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48915.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
        6⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43952.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
        6⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53923.exe
        7⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
        7⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9655.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60303.exe
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        6⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
        6⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        5⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42473.exe
        6⤵
        
        PID:15928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1591.exe
        5⤵
        
        PID:9200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
        5⤵
        
        PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        7⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21845.exe
        7⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7822.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45696.exe
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53235.exe
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42849.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53952.exe
      4⤵
      PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21893.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58244.exe
        5⤵
        
        PID:12528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        5⤵
        
        PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19246.exe
      4⤵
      PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33020.exe
        5⤵
        
        PID:16272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52644.exe
      4⤵
      PID:12544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
      4⤵
      PID:15784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36971.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55545.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        6⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4668.exe
        7⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        8⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7131.exe
        8⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11793.exe
        8⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40407.exe
        7⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        7⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        7⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49292.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        7⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40826.exe
        7⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38295.exe
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22263.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11870.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27738.exe
        6⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        5⤵
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
        6⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        7⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
        7⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58617.exe
        7⤵
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9655.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
        6⤵
        
        PID:408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        6⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        6⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        5⤵
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        6⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62185.exe
        6⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        5⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
        5⤵
        
        PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28819.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
        5⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
        6⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
        8⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
        8⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60478.exe
        8⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        7⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        7⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        7⤵
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36707.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57505.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        7⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56768.exe
        6⤵
        
        PID:13464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        6⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        6⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-693.exe
        6⤵
        
        PID:15964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26732.exe
        5⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55294.exe
        5⤵
        
        PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
      4⤵
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60797.exe
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13466.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        6⤵
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        5⤵
        
        PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe
        5⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        5⤵
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        5⤵
        
        PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe
      4⤵
      PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22137.exe
        5⤵
        
        PID:11184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13239.exe
        5⤵
        
        PID:15356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        5⤵
        
        PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30014.exe
      4⤵
      PID:10188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36699.exe
      4⤵
      PID:13384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
      4⤵
      PID:16220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38175.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3184.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
        5⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10652.exe
        7⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        7⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
        7⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe
        6⤵
        
        PID:13468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28819.exe
        6⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27003.exe
        5⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
        6⤵
        
        PID:11768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        6⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59779.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
        5⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
        5⤵
        
        PID:9840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32851.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        6⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        6⤵
        
        PID:15368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52520.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64936.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42473.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
        5⤵
        
        PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
      4⤵
      PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58244.exe
      4⤵
      PID:10736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
      4⤵
      PID:14876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
      4⤵
      PID:7476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        5⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18947.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        6⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        5⤵
        
        PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        5⤵
        
        PID:9572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
      4⤵
      PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1612.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
      4⤵
      PID:8948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
      4⤵
      PID:12632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49510.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
    3⤵
    PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22645.exe
      4⤵
      PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8908.exe
        5⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        5⤵
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        5⤵
        
        PID:10884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36811.exe
      4⤵
      PID:9920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44987.exe
      4⤵
      PID:13008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16643.exe
      4⤵
      PID:15780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
      4⤵
      PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52732.exe
    3⤵
    PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
      4⤵
      PID:11800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
      4⤵
      PID:14612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18869.exe
      4⤵
      PID:4312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
    3⤵
    PID:9804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32234.exe
    3⤵
    PID:13360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
    3⤵
    PID:16268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65123.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65123.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-812.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56749.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51160.exe
        5⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-200.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        7⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        7⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40215.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12498.exe
        6⤵
        
        PID:11712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5019.exe
        6⤵
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63027.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        6⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        6⤵
        
        PID:13416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        6⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1591.exe
        5⤵
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        5⤵
        
        PID:12712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52240.exe
        5⤵
        
        PID:16356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56905.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10652.exe
        8⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6898.exe
        8⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38643.exe
        7⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
        7⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        7⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59788.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe
        6⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15870.exe
        6⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51596.exe
        5⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
        6⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6747.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        6⤵
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21845.exe
        6⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40958.exe
        5⤵
        
        PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46587.exe
      4⤵
      PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
        5⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
        6⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        6⤵
        
        PID:9280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        5⤵
        
        PID:10368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48635.exe
        5⤵
        
        PID:14132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62835.exe
        5⤵
        
        PID:8716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
      4⤵
      PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
      4⤵
      PID:12028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7356.exe
      4⤵
      PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18322.exe
      4⤵
      PID:9548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64829.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11980.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        7⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
        8⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43597.exe
        8⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35233.exe
        7⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13082.exe
        6⤵
        
        PID:12328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        6⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
        6⤵
        
        PID:11520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7180.exe
        6⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52048.exe
        6⤵
        
        PID:12076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        6⤵
        
        PID:14304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62835.exe
        6⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52519.exe
        5⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31330.exe
        6⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
        5⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30754.exe
        5⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
        5⤵
        
        PID:16156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
      4⤵
      PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28997.exe
        5⤵
        
        PID:1640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 720
        6⤵
        Program crash
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7403.exe
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16119.exe
        5⤵
        
        PID:13604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        5⤵
        
        PID:10120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
      4⤵
      PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        5⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31537.exe
        5⤵
        
        PID:16064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
      4⤵
      PID:10652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe
      4⤵
      PID:14532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe
      4⤵
      PID:9248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58353.exe
        5⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18081.exe
        6⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        5⤵
        
        PID:13332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64999.exe
        5⤵
        
        PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35939.exe
      4⤵
      PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        5⤵
        
        PID:12356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        5⤵
        
        PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
      4⤵
      PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30764.exe
      4⤵
      PID:14524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe
      4⤵
      PID:9832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
    3⤵
    PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45141.exe
      4⤵
      PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20283.exe
      4⤵
      PID:10848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30370.exe
      4⤵
      PID:15692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
      4⤵
      PID:7280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22178.exe
    3⤵
    PID:7880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
    3⤵
    PID:10820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13220.exe
    3⤵
    PID:15120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
    3⤵
    PID:9772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36521.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47953.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8996.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        6⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56453.exe
        7⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23023.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60940.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        6⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        5⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
        6⤵
        
        PID:13236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13519.exe
        5⤵
        
        PID:12740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51371.exe
        5⤵
        
        PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29971.exe
      4⤵
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62229.exe
        5⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28805.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10904.exe
        7⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        7⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64388.exe
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe
        6⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5466.exe
        6⤵
        
        PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe
        5⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52379.exe
        5⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
        5⤵
        
        PID:13736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6292.exe
        5⤵
        
        PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23774.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21353.exe
        5⤵
        
        PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
        5⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30814.exe
        5⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63027.exe
        5⤵
        
        PID:16172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
      4⤵
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe
      4⤵
      PID:13140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24041.exe
      4⤵
      PID:1780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38737.exe
      4⤵
      PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31057.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8311.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59788.exe
        5⤵
        
        PID:11484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55294.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26117.exe
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        5⤵
        
        PID:12552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        5⤵
        
        PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56551.exe
      4⤵
      PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13329.exe
      4⤵
      PID:15712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65087.exe
    3⤵
    PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21389.exe
      4⤵
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24361.exe
        6⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
        6⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        5⤵
        
        PID:11044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        5⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe
        5⤵
        
        PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36707.exe
      4⤵
      PID:532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
      4⤵
      PID:11028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22621.exe
      4⤵
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44851.exe
    3⤵
    PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49557.exe
      4⤵
      PID:8480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54736.exe
      4⤵
      PID:10408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
      4⤵
      PID:3932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56100.exe
    3⤵
    PID:9852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
    3⤵
    PID:12964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
    3⤵
    PID:15748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
      4⤵
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9868.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
        6⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe
        7⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
        7⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
        7⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
        6⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        6⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
        5⤵
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52379.exe
        5⤵
        
        PID:10744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52108.exe
        5⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4393.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
      4⤵
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        5⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        5⤵
        
        PID:13368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57678.exe
        5⤵
        
        PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
      4⤵
      PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21051.exe
      4⤵
      PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23162.exe
      4⤵
      PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
      4⤵
      PID:8356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe
    3⤵
    PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
      4⤵
      PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64018.exe
        5⤵
        
        PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
      4⤵
      PID:11052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40432.exe
      4⤵
      PID:14272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
      4⤵
      PID:3180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12342.exe
    3⤵
    PID:8056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
    3⤵
    PID:11112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24174.exe
    3⤵
    PID:13840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
    3⤵
    PID:16108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18559.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18559.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64777.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56713.exe
      4⤵
      PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        5⤵
        
        PID:8136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        5⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1126.exe
        5⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        5⤵
        
        PID:8180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe
      4⤵
      PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
      4⤵
      PID:11148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31828.exe
      4⤵
      PID:16156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
      4⤵
      PID:6324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
    3⤵
    PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63257.exe
      4⤵
      PID:9636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
      4⤵
      PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35590.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4226.exe
    3⤵
    PID:8292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
    3⤵
    PID:6844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
    3⤵
    PID:8832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
  2⤵
  PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32697.exe
    3⤵
    PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe
      4⤵
      PID:10452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6311.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
      4⤵
      PID:9536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11731.exe
    3⤵
    PID:11840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
    3⤵
    PID:15864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
    3⤵
    PID:15920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25874.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25874.exe
  2⤵
  PID:7672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34965.exe
    3⤵
    PID:11540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
    3⤵
    PID:15560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
    3⤵
    PID:6412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13539.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13539.exe
  2⤵
  PID:10600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
  2⤵
  PID:15140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15580.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15580.exe
  2⤵
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
  2⤵
  PID:8144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4408 -ip 4408
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4632 -ip 4632
1⤵
PID:8748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1640 -ip 1640
1⤵
PID:9812

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe

Filesize
468KB

MD5
ca38c9234d9a6c1d183d27ada4a43d67

SHA1
06259da326c2014e29c351152fea60701661cbdb

SHA256
004c2876e9c38071ef435689521ce8fbf393ac5b2fdb449765baa7b9c6361ae9

SHA512
118b5ab2af27f25a743070817679e48e3bbe084eceb0f6d9b63f48cd44e23664bd36e56779baafe06723ecbaa1cf50629013f3480b603cf96f76ab64379695a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12436.exe

Filesize
468KB

MD5
f41151cd2f8ecf6186ff5e54539e3714

SHA1
df0a07add90909ff9f01875f844347bb067dff88

SHA256
cd637e8787eaf42c95dc49b2df8df81ee65114cd2539fbe5ab839fdcaa377f02

SHA512
66a915299f10c802978be277067f03a8ecdbce99ba785db221ab83186435d7c1bd3d75aff817db11e45ca7e07723600efa6e802c8783ebe7db097fd18db2f249

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe

Filesize
468KB

MD5
a6d635aab530494d4793c03feeb21f52

SHA1
e4d5d7e2cd272095c3bcde936a79791ebc5cc5b2

SHA256
495ba9a156502831c1392a19033e9fd9a5483d3d36d3b6c464d0435b25f6ab70

SHA512
be09a95fb4c03378a82f8e6f8dd5836bd4d71c461618147fa2087f43a702268f8b13490be6891889fcca892b4baaf8457fd96d0a2aab7b89fc2a9af22b0649a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe

Filesize
468KB

MD5
e0e65bdc9f87daa623c84f2a3e0237f5

SHA1
08b10622925e514f63c00b58b89f19d009f35308

SHA256
3d2bdc8cda3a4219e791162bdf2e19ca08d272fd20d41aa36c2eda024291a354

SHA512
0bf552d96913ce3f50dd38033a61f4092acfd4d4fc010fe80d56ab8da4a5a1c996bedbba2ca33991b7917bd1e85440fb13b6301daa1bbb58edd02af1c115a3be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe

Filesize
468KB

MD5
227b311fa433b98834e2abc674d62fbb

SHA1
fe8ead996202f1d1204230aa51da137bea7a6aa5

SHA256
1468a0e29fa2c96749a22ffdf69db3f4dfb1c5bfc226df732b052d686bf225c8

SHA512
9bf521e48ce988a990a06293fda554b31263f3e7446baff9472ea47934f9b14165e85d2063fd112b323c0f69c528d7b7b22f0e91cc6505e7c32965d9510c307c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe

Filesize
468KB

MD5
e90b0b63431d14fe35b9f7b65f7530df

SHA1
8d4781183de5a158f69765f7ba684ad27b8f3a90

SHA256
28de73c3892bbc29b2871c57f4524df3d8bf1f60a6a89c16a2bed2935abad39d

SHA512
8a036f320f181c0227e9eaa84cf877375f2608490a11562585190df4cce664b827526ed6abffe29fe182e4fc9f19ad89f75bc6b13128de3cda102437d4561bd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe

Filesize
468KB

MD5
65680f93ef50fff5a5f4d4b885348209

SHA1
a2b29216fd0a9f2179e67942f9af89ce4a221a84

SHA256
583fee5c84f39489dba19aaa9b138866e2ae8cb39be18fcd3a29b0888b22b26e

SHA512
4fd761f8fa792519ad43ec963d851e0295c6326c8734ad450d893bf0e97c1a6608c24d48127460686231c5ac2cc8f8b22ad6b3cfb22df28f764b0f78c5d75b2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe

Filesize
468KB

MD5
3dbe4aa723bfbeeb7f5f03012fc83ed6

SHA1
286e08f5193211399114cbc9ff8d846b66f8b609

SHA256
6fa90a2e9354f03ffdb1a6de2c42fb7083f9983922fb61b95ca585d1fbaa3c6b

SHA512
299b9936dbcef3dba6e38cd5d097f6c63a419a06950079ac5adf0005ce68556c32fc3f7a996b0367958cd31b3c625b4da29b7c838082d61179d3672221891463

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe

Filesize
468KB

MD5
da63ac1cd94ef83eda39e5d7e6efb0bf

SHA1
e135836d3b46a3b6a633ac5aeaf07861f6adf587

SHA256
788a30606e7dec494ba843d40cf2a8de9ae13e59ee07e7b874818990729674c7

SHA512
75210765b218c669ba832aa7ca62ded3b18f135ba99003721effd4f71ec88e07193d3b4479ac3fbd21c5eb62a9d21e9cc033675b5bcce6544f5cc036590949ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe

Filesize
468KB

MD5
eec8548db38b19f4efd94b78bf1b14d1

SHA1
fa478e7eced85571c848138e7a577057bac60128

SHA256
d23846b7ced8a17afa735cdc500ce8833df541659bc4ed42ff25c0f4fa081094

SHA512
cd927bca89c32ff0bc87ee1c613e1f8202234be35e3e85d9c181dd5fd74fcb6cfa2611770a0463fa959ca989931c55d096ee32f83e318bb509799a5213a584f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe

Filesize
468KB

MD5
ed937dd34189317dccb68d6252791dd8

SHA1
1bd580abc064ac160960ff8a768a06cf794511be

SHA256
f00161c6d0087e51bdfa32a7e46548268e6374b90252b627fd40ce8d3bb3263e

SHA512
67802b3c46460173961667d1f899db47a600d2f04c62c064880faef182846959deb1b8239a8c5b75b9cac0499029057dcf2f6f6a65aa34f62afc166610f1c583

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35374.exe

Filesize
468KB

MD5
3d80c55cf8ef3fe8a65ee1d16a6d93eb

SHA1
ac8ab236ef3b0170fed8d995a2e21d40c8959add

SHA256
6a826a0202969fa638a1007fec6f9ca04201faa26840e0e924df412d554df63a

SHA512
d3c989f0f0e330ddb0386d188f483ed2fbfbc1595e99895073a0b44788ba41e1eacb08c3f3baf1e8b9425458c5d7bfd934f8e5c760b04ea2b4f1c238563bb071

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe

Filesize
468KB

MD5
3d112969036e934d8e4fdeef7cc2fb60

SHA1
ffc1ef80b33eaaa57c6bc3e0066ab19771e1610c

SHA256
edf107f6a96c23f56965b0eca25eb0d77f4be05fe43ac64ef03d8344b476f77b

SHA512
1a62cf43fbc4aef59a509f18f68cd517301f82ef8df66df6cf7b10e141d826f8531594eddf75f9f793b915d8b093104c2ea79970606a17ff8b6beba59881d5b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36521.exe

Filesize
468KB

MD5
6deb4e86c4be6a5f79b6f1e0c25eca04

SHA1
0a1ff194119226b4f57ea995bd6c4666dcc72af1

SHA256
245255babdcdb1ad3fca96072de4f94f34d82ce897ba9d6fec33d1b05ea0b12c

SHA512
cdbf21083c0d65f01484bf98c94ac380d147fa9117fd56de27820c706e1d36fc7214daaca6067312b5caad09b9064e53f0fc69082a6dc66ef5a8b2c996e8bfe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36971.exe

Filesize
468KB

MD5
8cf6af6e3bd90666fdef9992ca1d7770

SHA1
6779ed8419dec3af1dad52259ea6fa4824d2725a

SHA256
7997fed574672ba0d2b4cca0237d8a5ace038ead04124a63bdb5831fae1322a7

SHA512
f6459dc888700d03ccc91e057a41dc37b877ac96579b528dbfd2922f08565728f6e18b31038f4dabdc91be3341d6905799bd87a64dc7c2aae0d52f8f96cb4688

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37984.exe

Filesize
468KB

MD5
88060565e4b53eb7c2e7beb8a1fb1517

SHA1
62b8bf5de1638450363cb31c9357760ccb622971

SHA256
db63aba4c5cd64ec0e304c2d9ee4eed50d910cc7da09956c275bc2bf8d4f7db9

SHA512
8c987ce124db65b5bd4c17423883e703edfd42eb7f76803b9ceb026cd93fc0bd05b8f4d637ff21cb07ce43ee3a7b88194827d4a6658e50186ceb4b2988044fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38175.exe

Filesize
468KB

MD5
0ab88901b5287102d2bc2741d98ea8e4

SHA1
2f91f20dc8feec6e34dadd0fae6b09ead044a809

SHA256
7c22673a4e3a04fc1e2996cf7a7d2eda5d1dfa67e516cae60b40c1200af6da54

SHA512
0e32111d21ac0c89c749d046c7e424098a84a60d7d7464d77581c091546093530d19dcb887e1efcf28e942824ed4fae65a313b196bbe340b910535ce4ab03b2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4019.exe

Filesize
468KB

MD5
cedffef7f963f40dabf2a093e14cf5f4

SHA1
e6e71c7075994e085a7389718d6c45ba4480b600

SHA256
61c5d09760a0e827046941ddf8c4b2806843a46d4515e56aad1d98eca5aeff5a

SHA512
bd7d756684055ea1051ac104df587f4eb370e414127443fbfa6fccb71b4093218f084fd8f39c592e776aa491d51082353b0a1d975be167a8d1c79569e191b786

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40605.exe

Filesize
468KB

MD5
9ed5a1d522ddb757c922a4db9afb23d9

SHA1
bcac6b6479e4e9df2d8bcdf18ad3fc05b61fdfce

SHA256
69a54b6102de7b46f516975ef699796efa34c77b2a553bfb71273ec47c41dd2a

SHA512
9a625183295c665e2f2aa0c68fed0264c673110743d61c1517df1af2a72c56e4d9c164319e21970ecce9b8e4e9c3ac9d69663aef6b32b1b36d269e9041721e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe

Filesize
468KB

MD5
1c4b3f3fa9ae541b6026ce04b99ea975

SHA1
812fdfe48245784db2837002abdfdca9b5609ef9

SHA256
519cdb49a69567aa835e7f42c188bafe58a8213ba7f842dab96d232187c072ad

SHA512
0bbba7f03b68aac3bcf39dca077587ec74b43d1d743084304d5f865dd8ce638cd69a5a603f664df705e0a9332b3f220264c24b292a898551797eefda2bc6e971

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe

Filesize
468KB

MD5
d0dad28fe2886e27a0a1bb24729ef1e9

SHA1
744850a0477ef6f2e3032bbc9a9049181a60713f

SHA256
eed9c03867c7feee9d2b07231f42e4fe4e94c6eeca19c2911fe378353930a6cd

SHA512
66576df975199ddac07b08d00b1a8c2014c06952bee21b1e886b88e3b31583ceafd07e96bb795881ccebd38844eaa44651d3037104c9759e4abe1ec992160a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe

Filesize
468KB

MD5
835de7e0096f10243d28d107706b2e21

SHA1
4e7595ee8d104a0f43a0ea126c618c5f556b92f2

SHA256
0ab2385f279266e18bff65ac76cbbd51db20f4d6f28ed5e3ef6b7bf985c48f7c

SHA512
e0d0234b53e12f1dd9ddb20a14fb722950014b0d11f5310204afde5495cd1ee31175bf4ee8f689d4f8ca346ae3e583ef4f895969a1b57f9b9148925d701da744

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe

Filesize
468KB

MD5
3045ba6bbaf103a3417ade2c00b4ec79

SHA1
27ca041217421f381c9a1625ea98bcd960e1803b

SHA256
a9d481e974bec555e89f332706d00f63c20705ced5597f9f9225fb577afb06eb

SHA512
2e230bf08ad63db8280dc705d96428d72159768134aba4939d4cfea9a8da251688a8d374288353852a08e0f7aeb92f6169e4b70a8decb1e4e9e4e0f11ce93399

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51689.exe

Filesize
468KB

MD5
c9ca8309b10e59ad7e41fcd08ae660b1

SHA1
1603677694fb73d79dc7a5c0cd280bf818065396

SHA256
c8a96b06cea4128e3644cf4d2323749da33e4aa2806b76539d102c0476634fe3

SHA512
f0d23ecedc05736dd6a61605ca04242fcf6c997d1e1416df290c12cc6cd190f37e08e04d473d76b822baf3c151728c6796779720d2926cd764ba9eaf0f22f75b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56135.exe

Filesize
468KB

MD5
da72bbdf42f44c219fc64edb943547fe

SHA1
6d6abae9c184a70fec879f01bd30e14d2d4164bf

SHA256
58f6583802fcf7497abe6c3f685a49801470e2fd7520c73fd9acac2b25051db2

SHA512
5aabd11cf1f00b34c49adc8164261d01a2c116d3743676ba7f22c15981c9561517836ecaed7baef20e4d0fae0a6ee92a9b058e9ff84a52ccc6eb3d9580c8a946

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56749.exe

Filesize
468KB

MD5
8ee0d2e6d8d8618ae4d27f7c4b0861b9

SHA1
decea84183592d90b5b7d87ca9c2ee1ef36f8f4f

SHA256
b70bba0a4dd60e885bf7ecc14f1329686c97d0d82749029567131aa78023a2e8

SHA512
e36a478218bd4748effe41c2bc44cd646d651e0fae36ded62a0e4115f5412fde8f20f9a36b6d1fe7b1ff15b35fad57bdd80871d847cc7533529c4c8706aa6650

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe

Filesize
468KB

MD5
abd1d2fa6978e7478f3bf5231540c5d0

SHA1
607ca9fd06c8fe0bf3ac55e5bb9d3eb354435d2c

SHA256
a734784bf0b8a311ddb177ed3b8a9f065e65c0288b4626dbc472c14fca488888

SHA512
76dab25ffcfc9ec55c03707daebb907b13d5c1da86f48e7597958b887406d48313b96bb4bd1cb7b5e78ee768f7726ceb443f4822380267d2d242f8a8c69e26ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe

Filesize
468KB

MD5
261a88570e48e6974c0a7948e64b913a

SHA1
01923cbef680a7076852d264ba0141adf47eb719

SHA256
871ef6f8189c9834eeedbf7c3d912566f3f6d270da9b63f310122b53fe5bd342

SHA512
f7bd9bd66b64bf24e9c609735d778c16d8919dc816177b662e12216c26d6e102fced4750dd5dc708e0f95c1c1acbacea6f5b35fa9d70fadf769e94adb2d2893f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64917.exe

Filesize
468KB

MD5
b6123e2e17a084ead67ed743d71372cd

SHA1
c46f53726f5624fe71e32880c1cdc48deeda1dba

SHA256
4bbf93b26f0cf330deb0401d0b067bc01c4d72f8d5dd2f75b4ff5f2ed402d3b3

SHA512
b42ce673533c3613672d810ef85aaf289d2f863ce7f2127177edc55a5d7cb9d66138e133297b19d8eb16615a72707f3236554dac1538383713b5c1ac19b65a5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65123.exe

Filesize
468KB

MD5
b242927345157f74da7a8a0698bbf617

SHA1
a3edc6e181aea1e3f1c2c02cb2545c81712c9a50

SHA256
f8274ab3c67d246e356183296bf5d5ec443b63256ddae8f1439f077c1fc911e4

SHA512
f975a1f883a47933d20d9b52a7f65c852a851aac98aff6661e10b93b315f579b32138dd5b6b8bbf6c2973f73af0febcc0bffddf780afccb3374faf547da9b09b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-812.exe

Filesize
468KB

MD5
9b3017c9bd337a11bd69bd959089d32f

SHA1
9ce85c3c2688047da6950f3a07ddccd5643c0da0

SHA256
c8a1c978cf071aa2790b7ccf8f0ce05849f25a8128fdf67e16d71c0681272996

SHA512
d8ac1f3f815ed9cf87bc7e82a468cfe3a3b9ae150b29c51bb48c6c7b1ce639667daba539205dfdcb5b261152ce4f18b247d5d80089cc84420e670a1d196c53f6

Download Submit
memory/548-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/552-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-2583-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/896-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/972-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1008-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1016-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1040-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1064-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1132-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1468-53-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1472-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1484-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1496-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1848-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-2595-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-30-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2956-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3084-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3100-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3400-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3592-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3804-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3892-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3964-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3980-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4028-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4384-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4412-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4556-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4612-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4668-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4744-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4768-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4784-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5144-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5156-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5244-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5284-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5460-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5548-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5560-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5588-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5612-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5624-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5632-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5656-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5752-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5804-583-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5812-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5848-601-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5932-604-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16056-2552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16072-2551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16288-2717-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads