7520ee2f5d8e4fe264bac309376b653291fe73e150c872e6034b0c495a9dd9ef

Analysis

max time kernel
119s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4fdc09a1d9fd9b04563da0ba8286a50N.exe
Size

468KB
MD5

c4fdc09a1d9fd9b04563da0ba8286a50
SHA1

9c9564da59ecb3c9ec5c62b6b8dc0b69b45ec59c
SHA256

7520ee2f5d8e4fe264bac309376b653291fe73e150c872e6034b0c495a9dd9ef
SHA512

56753c446c6a7224e910c91beeae7ccc692a8ad04614910662a24fbe35a7b7b82451039cd0dd000cfd5f64e320b0dd1cda0c52ca27f57a1ff1029da1bcd6da36
SSDEEP

3072:dboIogZv+P88U2aYwPzivff8GMC7AZ4pmhdHgZVrOumQpBEOozaYu:dbzohRU2oPevffoEVuum8COoz

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3460	Unicorn-4699.exe
4924	Unicorn-11243.exe
3964	Unicorn-52831.exe
540	Unicorn-6339.exe
4248	Unicorn-59432.exe
2240	Unicorn-39566.exe
4608	Unicorn-53302.exe
4736	Unicorn-4139.exe
4372	Unicorn-37558.exe
512	Unicorn-24560.exe
4488	Unicorn-61700.exe
2384	Unicorn-59654.exe
2176	Unicorn-65519.exe
2640	Unicorn-41834.exe
2400	Unicorn-48223.exe
3228	Unicorn-43392.exe
4492	Unicorn-64964.exe
3976	Unicorn-64964.exe
1896	Unicorn-24486.exe
2752	Unicorn-1657.exe
4648	Unicorn-28762.exe
2936	Unicorn-32292.exe
4328	Unicorn-28208.exe
4552	Unicorn-11295.exe
4992	Unicorn-48799.exe
396	Unicorn-60231.exe
2852	Unicorn-52136.exe
5088	Unicorn-62534.exe
4512	Unicorn-35037.exe
1036	Unicorn-10091.exe
1676	Unicorn-28465.exe
2116	Unicorn-58716.exe
3412	Unicorn-29936.exe
1156	Unicorn-29936.exe
1180	Unicorn-21960.exe
3916	Unicorn-5623.exe
4704	Unicorn-6474.exe
2668	Unicorn-52411.exe
4824	Unicorn-64108.exe
1300	Unicorn-60024.exe
1636	Unicorn-60579.exe
2236	Unicorn-55556.exe
4716	Unicorn-55556.exe
5048	Unicorn-2826.exe
2248	Unicorn-31606.exe
1628	Unicorn-19162.exe
2152	Unicorn-32897.exe
548	Unicorn-7315.exe
624	Unicorn-56516.exe
2088	Unicorn-48348.exe
1044	Unicorn-10637.exe
4432	Unicorn-59639.exe
3876	Unicorn-39988.exe
2028	Unicorn-31820.exe
724	Unicorn-25689.exe
4908	Unicorn-7870.exe
3344	Unicorn-19302.exe
1172	Unicorn-62115.exe
2832	Unicorn-24612.exe
4224	Unicorn-44456.exe
1020	Unicorn-3807.exe
1696	Unicorn-36023.exe
3108	Unicorn-33142.exe
4324	Unicorn-41716.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
15744	14044	WerFault.exe	663
14636	14136	WerFault.exe	668
15840	7912	WerFault.exe	330
13308	14052	WerFault.exe	664

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23977.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	13120	dwm.exe
Token: SeChangeNotifyPrivilege	13120	dwm.exe
Token: 33	13120	dwm.exe
Token: SeIncBasePriorityPrivilege	13120	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe
3460	Unicorn-4699.exe
4924	Unicorn-11243.exe
3964	Unicorn-52831.exe
540	Unicorn-6339.exe
4248	Unicorn-59432.exe
4608	Unicorn-53302.exe
2240	Unicorn-39566.exe
4736	Unicorn-4139.exe
4372	Unicorn-37558.exe
512	Unicorn-24560.exe
4488	Unicorn-61700.exe
2384	Unicorn-59654.exe
2640	Unicorn-41834.exe
2176	Unicorn-65519.exe
2400	Unicorn-48223.exe
3228	Unicorn-43392.exe
3976	Unicorn-64964.exe
4492	Unicorn-64964.exe
1896	Unicorn-24486.exe
2752	Unicorn-1657.exe
4648	Unicorn-28762.exe
4552	Unicorn-11295.exe
2936	Unicorn-32292.exe
4328	Unicorn-28208.exe
396	Unicorn-60231.exe
2852	Unicorn-52136.exe
5088	Unicorn-62534.exe
4992	Unicorn-48799.exe
4512	Unicorn-35037.exe
1036	Unicorn-10091.exe
1676	Unicorn-28465.exe
2116	Unicorn-58716.exe
1180	Unicorn-21960.exe
3412	Unicorn-29936.exe
1156	Unicorn-29936.exe
3916	Unicorn-5623.exe
2668	Unicorn-52411.exe
1300	Unicorn-60024.exe
4824	Unicorn-64108.exe
4704	Unicorn-6474.exe
1636	Unicorn-60579.exe
4716	Unicorn-55556.exe
2236	Unicorn-55556.exe
5048	Unicorn-2826.exe
2152	Unicorn-32897.exe
1628	Unicorn-19162.exe
2248	Unicorn-31606.exe
548	Unicorn-7315.exe
624	Unicorn-56516.exe
2088	Unicorn-48348.exe
4908	Unicorn-7870.exe
1044	Unicorn-10637.exe
2028	Unicorn-31820.exe
4432	Unicorn-59639.exe
3876	Unicorn-39988.exe
724	Unicorn-25689.exe
3344	Unicorn-19302.exe
1172	Unicorn-62115.exe
2832	Unicorn-24612.exe
4224	Unicorn-44456.exe
1696	Unicorn-36023.exe
1020	Unicorn-3807.exe
3108	Unicorn-33142.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 3460	3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe	87
PID 3288 wrote to memory of 3460	3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe	87
PID 3288 wrote to memory of 3460	3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe	87
PID 3460 wrote to memory of 4924	3460	Unicorn-4699.exe	88
PID 3460 wrote to memory of 4924	3460	Unicorn-4699.exe	88
PID 3460 wrote to memory of 4924	3460	Unicorn-4699.exe	88
PID 3288 wrote to memory of 3964	3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe	89
PID 3288 wrote to memory of 3964	3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe	89
PID 3288 wrote to memory of 3964	3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe	89
PID 4924 wrote to memory of 540	4924	Unicorn-11243.exe	94
PID 4924 wrote to memory of 540	4924	Unicorn-11243.exe	94
PID 4924 wrote to memory of 540	4924	Unicorn-11243.exe	94
PID 3964 wrote to memory of 4248	3964	Unicorn-52831.exe	96
PID 3964 wrote to memory of 4248	3964	Unicorn-52831.exe	96
PID 3964 wrote to memory of 4248	3964	Unicorn-52831.exe	96
PID 3288 wrote to memory of 4608	3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe	95
PID 3288 wrote to memory of 4608	3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe	95
PID 3288 wrote to memory of 4608	3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe	95
PID 3460 wrote to memory of 2240	3460	Unicorn-4699.exe	97
PID 3460 wrote to memory of 2240	3460	Unicorn-4699.exe	97
PID 3460 wrote to memory of 2240	3460	Unicorn-4699.exe	97
PID 540 wrote to memory of 4736	540	Unicorn-6339.exe	99
PID 540 wrote to memory of 4736	540	Unicorn-6339.exe	99
PID 540 wrote to memory of 4736	540	Unicorn-6339.exe	99
PID 4924 wrote to memory of 4372	4924	Unicorn-11243.exe	100
PID 4924 wrote to memory of 4372	4924	Unicorn-11243.exe	100
PID 4924 wrote to memory of 4372	4924	Unicorn-11243.exe	100
PID 4248 wrote to memory of 512	4248	Unicorn-59432.exe	101
PID 4248 wrote to memory of 512	4248	Unicorn-59432.exe	101
PID 4248 wrote to memory of 512	4248	Unicorn-59432.exe	101
PID 4608 wrote to memory of 4488	4608	Unicorn-53302.exe	102
PID 4608 wrote to memory of 4488	4608	Unicorn-53302.exe	102
PID 4608 wrote to memory of 4488	4608	Unicorn-53302.exe	102
PID 3460 wrote to memory of 2384	3460	Unicorn-4699.exe	103
PID 3460 wrote to memory of 2384	3460	Unicorn-4699.exe	103
PID 3460 wrote to memory of 2384	3460	Unicorn-4699.exe	103
PID 3288 wrote to memory of 2176	3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe	104
PID 3288 wrote to memory of 2176	3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe	104
PID 3288 wrote to memory of 2176	3288	c4fdc09a1d9fd9b04563da0ba8286a50N.exe	104
PID 3964 wrote to memory of 2640	3964	Unicorn-52831.exe	105
PID 3964 wrote to memory of 2640	3964	Unicorn-52831.exe	105
PID 3964 wrote to memory of 2640	3964	Unicorn-52831.exe	105
PID 2240 wrote to memory of 2400	2240	Unicorn-39566.exe	108
PID 2240 wrote to memory of 2400	2240	Unicorn-39566.exe	108
PID 2240 wrote to memory of 2400	2240	Unicorn-39566.exe	108
PID 4736 wrote to memory of 3228	4736	Unicorn-4139.exe	109
PID 4736 wrote to memory of 3228	4736	Unicorn-4139.exe	109
PID 4736 wrote to memory of 3228	4736	Unicorn-4139.exe	109
PID 4372 wrote to memory of 3976	4372	Unicorn-37558.exe	110
PID 4372 wrote to memory of 3976	4372	Unicorn-37558.exe	110
PID 4372 wrote to memory of 3976	4372	Unicorn-37558.exe	110
PID 512 wrote to memory of 4492	512	Unicorn-24560.exe	111
PID 512 wrote to memory of 4492	512	Unicorn-24560.exe	111
PID 512 wrote to memory of 4492	512	Unicorn-24560.exe	111
PID 540 wrote to memory of 1896	540	Unicorn-6339.exe	112
PID 540 wrote to memory of 1896	540	Unicorn-6339.exe	112
PID 540 wrote to memory of 1896	540	Unicorn-6339.exe	112
PID 4924 wrote to memory of 2752	4924	Unicorn-11243.exe	113
PID 4924 wrote to memory of 2752	4924	Unicorn-11243.exe	113
PID 4924 wrote to memory of 2752	4924	Unicorn-11243.exe	113
PID 4248 wrote to memory of 4648	4248	Unicorn-59432.exe	114
PID 4248 wrote to memory of 4648	4248	Unicorn-59432.exe	114
PID 4248 wrote to memory of 4648	4248	Unicorn-59432.exe	114
PID 4488 wrote to memory of 2936	4488	Unicorn-61700.exe	115

C:\Users\Admin\AppData\Local\Temp\c4fdc09a1d9fd9b04563da0ba8286a50N.exe
"C:\Users\Admin\AppData\Local\Temp\c4fdc09a1d9fd9b04563da0ba8286a50N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3807.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
        9⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        10⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        11⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        10⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1825.exe
        10⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33831.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11667.exe
        10⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        10⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16731.exe
        10⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        9⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe
        9⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        8⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe
        9⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53312.exe
        10⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14281.exe
        10⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13794.exe
        9⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
        9⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
        9⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe
        8⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
        9⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14096.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        8⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        8⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
        8⤵
        
        PID:14068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33142.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
        8⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        9⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42626.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        9⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29598.exe
        8⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17304.exe
        9⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        9⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1695.exe
        8⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe
        8⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17853.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        8⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        8⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        8⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14879.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
        8⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
        7⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40366.exe
        7⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19891.exe
        7⤵
        
        PID:456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19162.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10387.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        8⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe
        9⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17858.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57758.exe
        9⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19317.exe
        9⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10115.exe
        9⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8986.exe
        8⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22589.exe
        8⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5909.exe
        8⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        8⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        8⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
        8⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30606.exe
        7⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5025.exe
        6⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
        8⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
        8⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14297.exe
        8⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
        8⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41614.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53010.exe
        7⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        7⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
        6⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35933.exe
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        6⤵
        
        PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41716.exe
        7⤵
        Executes dropped EXE
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        9⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        10⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
        10⤵
        
        PID:14052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14052 -s 472
        11⤵
        Program crash
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        10⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        9⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        9⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32617.exe
        8⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe
        9⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        8⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26070.exe
        8⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        8⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        9⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12263.exe
        9⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        8⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        8⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10344.exe
        8⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11046.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58850.exe
        7⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41747.exe
        7⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54331.exe
        6⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1363.exe
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46732.exe
        8⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-598.exe
        8⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        8⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9271.exe
        8⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21054.exe
        7⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
        7⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63074.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        7⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        7⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49212.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10862.exe
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28637.exe
        6⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42536.exe
        6⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
        6⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21680.exe
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45764.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
        8⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9456.exe
        8⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        8⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        7⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37478.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
        6⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29746.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47071.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        7⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        7⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
        7⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe
        6⤵
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50681.exe
        6⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15541.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53312.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26741.exe
        6⤵
        
        PID:16308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30202.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        5⤵
        
        PID:13492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52672.exe
        5⤵
        
        PID:15720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64964.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29936.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
        8⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        9⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15433.exe
        9⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        9⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe
        8⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14687.exe
        9⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9202.exe
        9⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
        9⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42434.exe
        8⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        8⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
        8⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46212.exe
        8⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24641.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        8⤵
        
        PID:15348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
        8⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe
        7⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe
        7⤵
        
        PID:15764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        6⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21326.exe
        7⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        8⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46867.exe
        8⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
        8⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
        8⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        7⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63086.exe
        7⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63074.exe
        6⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
        7⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe
        7⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        6⤵
        
        PID:10600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        6⤵
        
        PID:14708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52411.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38208.exe
        6⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        8⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        8⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        8⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26956.exe
        8⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22013.exe
        7⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        7⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1918.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
        7⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        7⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe
        7⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44163.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe
        6⤵
        
        PID:112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        6⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53312.exe
        7⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63779.exe
        7⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38122.exe
        7⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1489.exe
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        6⤵
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10844.exe
        6⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48903.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15196.exe
        6⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46738.exe
        5⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32714.exe
        5⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        5⤵
        
        PID:16136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1657.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5623.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
        8⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63779.exe
        8⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38122.exe
        8⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        8⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        7⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44074.exe
        7⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5057.exe
        7⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        7⤵
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9317.exe
        6⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36960.exe
        7⤵
        
        PID:13840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        6⤵
        
        PID:15964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        5⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        7⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        8⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        8⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56327.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        7⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe
        7⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        6⤵
        
        PID:11884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44242.exe
        5⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        6⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44859.exe
        7⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        7⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34657.exe
        6⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30507.exe
        5⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
        6⤵
        
        PID:13864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12263.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
        5⤵
        
        PID:12284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6474.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5535.exe
        5⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        7⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52958.exe
        7⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34657.exe
        7⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
        6⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18313.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        6⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57943.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        6⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17817.exe
        5⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38390.exe
        5⤵
        
        PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24809.exe
      4⤵
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18852.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
        6⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26045.exe
        5⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33659.exe
        5⤵
        
        PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
      4⤵
      PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        5⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        5⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55239.exe
        5⤵
        
        PID:336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25260.exe
      4⤵
      PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64378.exe
      4⤵
      PID:14760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
      4⤵
      PID:16048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24612.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56480.exe
        8⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        8⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15433.exe
        8⤵
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5181.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        7⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        7⤵
        
        PID:15860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
        6⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        7⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8870.exe
        7⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
        6⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19118.exe
        6⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12219.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        8⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
        8⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        8⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56134.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34235.exe
        7⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        6⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        6⤵
        
        PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34560.exe
        6⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9569.exe
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48071.exe
        6⤵
        
        PID:15788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44347.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41044.exe
        6⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15513.exe
        5⤵
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        5⤵
        
        PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28465.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59972.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
        8⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        8⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17230.exe
        8⤵
        
        PID:14068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        7⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11401.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1165.exe
        7⤵
        
        PID:14704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11726.exe
        6⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        6⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
        5⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        6⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe
        7⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48580.exe
        7⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15433.exe
        6⤵
        
        PID:14692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60054.exe
        5⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51807.exe
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29687.exe
        5⤵
        
        PID:15216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36023.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        7⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5746.exe
        7⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        7⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        6⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        6⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        5⤵
        
        PID:15288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        5⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        6⤵
        
        PID:16300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        5⤵
        
        PID:14232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57247.exe
      4⤵
      PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38424.exe
        5⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
        6⤵
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        6⤵
        
        PID:16192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14895.exe
        5⤵
        
        PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3599.exe
      4⤵
      PID:12068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
      4⤵
      PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60024.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34124.exe
        6⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23961.exe
        7⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        8⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        8⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21429.exe
        7⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        7⤵
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        7⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13166.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3247.exe
        6⤵
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5706.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7922.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33100.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
        7⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13166.exe
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19841.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        6⤵
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13681.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24724.exe
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26830.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        6⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe
        6⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50935.exe
        5⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23977.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31606.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10387.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        7⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15433.exe
        7⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
        7⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41850.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        6⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30222.exe
        6⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe
        5⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        6⤵
        
        PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        5⤵
        
        PID:10264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        5⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
        5⤵
        
        PID:212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12041.exe
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41944.exe
        6⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        5⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe
        5⤵
        
        PID:15636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
      4⤵
      PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        5⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        5⤵
        
        PID:12668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52742.exe
      4⤵
      PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
      4⤵
      PID:13260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
      4⤵
      PID:15268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31820.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61946.exe
        7⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        7⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13026.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19997.exe
        6⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        5⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2169.exe
        5⤵
        
        PID:11824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1633.exe
        5⤵
        
        PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
      4⤵
      PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17072.exe
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6275.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        6⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        5⤵
        
        PID:14280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
      4⤵
      PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe
        5⤵
        
        PID:13152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe
        5⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
        5⤵
        
        PID:15760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43910.exe
      4⤵
      PID:12136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
      4⤵
      PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10637.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        6⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        5⤵
        
        PID:7480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
      4⤵
      PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29029.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33167.exe
      4⤵
      PID:14308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
      4⤵
      PID:5784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
    3⤵
    PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
      4⤵
      PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46710.exe
      4⤵
      PID:12124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53316.exe
    3⤵
    PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63750.exe
    3⤵
    PID:12016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
    3⤵
    PID:15956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44536.exe
    3⤵
    PID:7384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59432.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24560.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64964.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29936.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65208.exe
        8⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        9⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28860.exe
        10⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62139.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        10⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15382.exe
        9⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11017.exe
        9⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30075.exe
        9⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        8⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        8⤵
        
        PID:16176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21407.exe
        8⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42182.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33328.exe
        8⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        8⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18094.exe
        7⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        6⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        7⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29244.exe
        8⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
        8⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
        8⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4718.exe
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47063.exe
        7⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46540.exe
        7⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        7⤵
        
        PID:12624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8870.exe
        7⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        7⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        6⤵
        
        PID:10608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        6⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe
        6⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17508.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20500.exe
        8⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        8⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1103.exe
        8⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21054.exe
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
        7⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39004.exe
        7⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65483.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe
        7⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        7⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        7⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45070.exe
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        6⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2484.exe
        6⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3297.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        7⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        6⤵
        
        PID:15704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3402.exe
        5⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
        6⤵
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7442.exe
        5⤵
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25281.exe
        5⤵
        
        PID:16040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28762.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe
        6⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
        7⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        8⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        8⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        7⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
        7⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32892.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6410.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        7⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17266.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        6⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55675.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        6⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49228.exe
        7⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5730.exe
        7⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        7⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35122.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12441.exe
        6⤵
        
        PID:14076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65186.exe
        5⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe
        6⤵
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        6⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53239.exe
        5⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        5⤵
        
        PID:12520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25689.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
        5⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58039.exe
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12310.exe
        7⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        7⤵
        
        PID:13604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11401.exe
        6⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21324.exe
        6⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
        5⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        5⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        5⤵
        
        PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
      4⤵
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        5⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59996.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46909.exe
        6⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        5⤵
        
        PID:9744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
      4⤵
      PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52071.exe
      4⤵
      PID:12056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58866.exe
      4⤵
      PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
      4⤵
      PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41834.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe
        6⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1363.exe
        7⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        8⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        8⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37859.exe
        8⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29222.exe
        7⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
        7⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
        7⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        7⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        7⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        5⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7922.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48403.exe
        7⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11365.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9960.exe
        7⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        6⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        6⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63074.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1578.exe
        5⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16879.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18865.exe
      4⤵
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28068.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe
        7⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49212.exe
        7⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9569.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48071.exe
        6⤵
        
        PID:15780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        6⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60927.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        5⤵
        
        PID:12164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        5⤵
        
        PID:15788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62552.exe
        5⤵
        
        PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50107.exe
      4⤵
      PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49664.exe
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16497.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        5⤵
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
      4⤵
      PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
      4⤵
      PID:12644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23776.exe
      4⤵
      PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25432.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        7⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        7⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        6⤵
        
        PID:13824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        5⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        5⤵
        
        PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56302.exe
      4⤵
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        5⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36193.exe
        5⤵
        
        PID:15880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4082.exe
      4⤵
      PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
      4⤵
      PID:11956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64700.exe
      4⤵
      PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
      4⤵
      PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33600.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26120.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        6⤵
        
        PID:12692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        5⤵
        
        PID:15812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
      4⤵
      PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        5⤵
        
        PID:14536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
      4⤵
      PID:12184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
      4⤵
      PID:3404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
    3⤵
    PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
      4⤵
      PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
      4⤵
      PID:9296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64250.exe
      4⤵
      PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
      4⤵
      PID:6760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
    3⤵
    PID:7696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
    3⤵
    PID:12008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe
    3⤵
    PID:7532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32292.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45992.exe
        6⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41112.exe
        8⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        8⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        8⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11401.exe
        7⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51451.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        7⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        7⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        6⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
        6⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53252.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        7⤵
        
        PID:14272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60218.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29561.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58465.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
        5⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33779.exe
        5⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12633.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30727.exe
        5⤵
        
        PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52676.exe
        6⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        7⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        7⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63534.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58465.exe
        6⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21710.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56540.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28470.exe
        6⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22675.exe
        6⤵
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47374.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31055.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3873.exe
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9202.exe
        6⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        6⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe
        6⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25278.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        5⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52323.exe
      4⤵
      PID:7912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7912 -s 492
        5⤵
        Program crash
        
        PID:15840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26229.exe
      4⤵
      PID:10956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe
      4⤵
      PID:14908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
      4⤵
      PID:15248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48799.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7315.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64080.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        7⤵
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        6⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        6⤵
        
        PID:13416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21907.exe
        6⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
        5⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
        6⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        6⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        5⤵
        
        PID:11296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        5⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20943.exe
        5⤵
        
        PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        5⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32491.exe
        6⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        5⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36883.exe
        5⤵
        
        PID:16324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2877.exe
      4⤵
      PID:8124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24179.exe
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
    3⤵
    PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29952.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        5⤵
        
        PID:12580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe
        5⤵
        
        PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50219.exe
      4⤵
      PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30832.exe
        5⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        5⤵
        
        PID:16152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17109.exe
      4⤵
      PID:12836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
      4⤵
      PID:15432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25408.exe
      4⤵
      PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
    3⤵
    PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
      4⤵
      PID:10092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63278.exe
      4⤵
      PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14058.exe
    3⤵
    PID:9396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54248.exe
    3⤵
    PID:13156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19946.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56516.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8439.exe
        7⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        7⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18593.exe
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe
        6⤵
        
        PID:14136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14136 -s 504
        7⤵
        Program crash
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23941.exe
        6⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58659.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15700.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24386.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35698.exe
        5⤵
        
        PID:10500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
        5⤵
        
        PID:14720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe
        5⤵
        
        PID:14716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52551.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54980.exe
        5⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        6⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        5⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        5⤵
        
        PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59286.exe
      4⤵
      PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39826.exe
      4⤵
      PID:12100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7870.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
      4⤵
      PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13179.exe
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63320.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48867.exe
      4⤵
      PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        5⤵
        
        PID:15756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
      4⤵
      PID:12220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
      4⤵
      PID:14140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe
    3⤵
    PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
      4⤵
      PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
        5⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
        5⤵
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        5⤵
        
        PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe
      4⤵
      PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55617.exe
        5⤵
        
        PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64878.exe
      4⤵
      PID:13408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
      4⤵
      PID:7464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
    3⤵
    PID:8108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
    3⤵
    PID:12280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
    3⤵
    PID:11772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61692.exe
    3⤵
    PID:7924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
      4⤵
      PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41960.exe
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        6⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8870.exe
        6⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        6⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4858.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11785.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14044 -s 480
        6⤵
        Program crash
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
        5⤵
        
        PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49059.exe
      4⤵
      PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe
      4⤵
      PID:11684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
      4⤵
      PID:16176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
    3⤵
    PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42536.exe
      4⤵
      PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        5⤵
        
        PID:15700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        5⤵
        
        PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13794.exe
      4⤵
      PID:10564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
      4⤵
      PID:14752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
    3⤵
    PID:7612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
      4⤵
      PID:2512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1490.exe
    3⤵
    PID:10828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
    3⤵
    PID:15204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
    3⤵
    PID:5272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
    3⤵
    PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
      4⤵
      PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        5⤵
        
        PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31334.exe
      4⤵
      PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
      4⤵
      PID:12908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
      4⤵
      PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
      4⤵
      PID:12972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33962.exe
    3⤵
    PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57308.exe
      4⤵
      PID:11696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63675.exe
    3⤵
    PID:10432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
    3⤵
    PID:14748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56808.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56808.exe
  2⤵
  PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
    3⤵
    PID:7112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12310.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
    3⤵
    PID:15900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
  2⤵
  PID:8556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44382.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44382.exe
  2⤵
  PID:12392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
  2⤵
  PID:16272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
  2⤵
  PID:15520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
  2⤵
  PID:15164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:16152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 14044 -ip 14044
  2⤵
  PID:16188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 7912 -ip 7912
  2⤵
  PID:15748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 14052 -ip 14052
  2⤵
  PID:15580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 13152 -ip 13152
  2⤵
  PID:14324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 13260 -ip 13260
  2⤵
  PID:1440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 7596 -ip 7596
  2⤵
  PID:2556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 12676 -ip 12676
  2⤵
  PID:15404

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe

Filesize
468KB

MD5
ab5a0826b9b232c589862ef6ff3713e8

SHA1
441d7fce0754c91b842511d2c2833a37292132ce

SHA256
0f93a0c82db9921eba7d7f87f50d95b58da5b759bc0f502d7d38cb2a385d0d53

SHA512
1c19e121fa5df36f5ac96c89f26b25afb0eb308624a90d45107ed7a02350fb4d9586a99c6636edbbc89dbafbb9c3e6927851f7117d74b22d18c25703d463fcd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe

Filesize
468KB

MD5
c9ea178cdd4453f3dabb09d4fb20d22b

SHA1
4ba5ad7793e1dd75ccbbac632cc66fa49b463a68

SHA256
65725cb16c60f07f0a8dcc878f3b7eb3e5c5f33d53df532aed46b97c8836af7c

SHA512
1b96974fb9196d00b345e6c31e9c03cb531c653d9b15dfde8ad1e0802191b42ba110b4ae0e4d089bc9b83bd5960dc2e336e68d76b2d6e3917b45a2b6dab2cda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe

Filesize
468KB

MD5
15fd7cc65b07033ed21d0f4c4a27bedd

SHA1
2ecf25cbeeaa9c5598279dfbc1947490a87b83d5

SHA256
1c4b611ca5f6d2890eadf76931554f6fddf0522500277e4a5cd91562e1f4798f

SHA512
9b2d5ace49242c9735409972f5f8818e93c8a7844e83de05640e9158c72f02e7d3ad86085b1df9231c10726ace626f1bb37c7f1b051fd0b462442d8b34d7d30c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1657.exe

Filesize
468KB

MD5
3f6fadfb1bb493754a14507337ea36da

SHA1
4edebb8b5a61fcbff995ba47d87546fee94afd07

SHA256
dbaadf9fe359a00b65a358a650e739eb789b008a15b8289205afbceb2d359805

SHA512
e497d04b85486463c8ede145ef11c64f3b4de43ffab5a5478e703ac059421b1cc41e77f312e0a54a84e7133f1eb74fdc363d121b65c557778c1127e1c116465a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe

Filesize
468KB

MD5
839922ba757d7400af067377c28cfb84

SHA1
983d130287990a7829e25ceb9b62955d94c125ea

SHA256
013823f31d6914153e48f7b472002c4ab5fe1feb3247bb7ba755ec3e0b337c2a

SHA512
95b8e5541fa9ff6f2d487cb2388293eb4bb69e19b1b28ef3c23ff1acacc3541f96c930000d78b8fe85ecf125c1f5089eddccd47646c24f9a284e766f37db8f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24486.exe

Filesize
468KB

MD5
d119df1dec852308ee72a957160f38d7

SHA1
129a7ab475ecf636fcf3bbfc7e1270a2529f06b6

SHA256
94782dfac9808229e1c528d90aa460aafcd576deb870a84ea2d82282b377e7ad

SHA512
c72273dc245ec9e239178a31c0b38bff32df58622424494629adac105d80932c3e36471cd2a6fa94040737ca953e3e2bb1beb1db64858c89bb8aecb0265f0aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24560.exe

Filesize
468KB

MD5
095eeaf86b39898e3f0af6d94f0db3ad

SHA1
b503d814f4632d324754681f693b8779897e4b78

SHA256
51132c88d273171cd3282c325e13b371da7263b593e0cbeadbbc73f6f377e8ec

SHA512
6d373ee619283ab9ad2d48ef12596e7f738799d5f39d2558bd027f430fe5a4b4585a38a4b1fd94859de639a8a60f352b6d3f6d6e465df9e1cd19c87e54c040bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28208.exe

Filesize
468KB

MD5
523e51f05922af77512a943bc5d29d04

SHA1
3a573f0f46d56b9cd0ed8900b8a8954889444e7c

SHA256
cea70a4d6cddc02c60a159e9285350ab2bb8899e2eddcef25a6ed9004d799e21

SHA512
8b5d8304c55894e6100a2b0aa5b0ec4666121888283ee39bec41fe34cc0d74cd1cf36c0d5af3fe76448c67ebc5e6b5daf23d8dabc5a92bd1cff955b9b4285e91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28465.exe

Filesize
468KB

MD5
1680759506fd1ce7ff949db92895020d

SHA1
fa6ec63fdec7aa6cc4c5e9ba01d268ce033851da

SHA256
39d0927b97d7f9d2840d768ae26a167632e7a2b52256076a469376fd0423bf09

SHA512
00f367bcfba92b394afd3e761e4a3654bd50ddb1a23095b2a0d6b43b506f8a981e97d2e45cf4c81bbcfa1fce8ef308423297993e57416b5ddceaf90063eac690

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28762.exe

Filesize
468KB

MD5
d7c32c2238ff4a8d97d26af938add978

SHA1
fa95d7f4c7a5378deb04cfffafc2eb9c85ab6eaf

SHA256
ec9d69f46f0cf29c19cea207db288cca32c87833ddba710c867815d3b0106037

SHA512
00ba7fb5a3d50b030a6f010765beaee5abb7df5d02f727703040b505c3cca8e1c91c5ea0181dbb9617ca6c2549b9b89823c3d6495572abf93487ecbd6f85c9d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32292.exe

Filesize
468KB

MD5
a5847d736f009bc0c8647ca15d9a386b

SHA1
34514bed45bdf05b755010502e8c981a4a0063ab

SHA256
59de011491c4c75d862457fe55ddf24d0626eb06316db10af3e68b3688eee5b7

SHA512
3ce3b12836f36fe566e79c0d9273e12af5b07cff2e86b259b233095146060b519c195a17c778ef0a9ed6c9113cd0b5777b9567156b3ed3d78c8bebb87eefa64b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe

Filesize
468KB

MD5
ad97d1fad50e963ad0a1737a0151b6d3

SHA1
62aab3398bbde1e0f304312be5484a8dd406957a

SHA256
df0e30fa1bcaecb50a0b8bdcd2b0ebeac3a1c557536f02594d80d781d471c572

SHA512
8a5ebfa7df18975d980407ba975ce8962dcc7a5fd06da1cb66ed43e7aa2dd33b67191084a6a281e95418f6788e7b583b0bc436c13843016118a0c0d6ed4f96e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe

Filesize
468KB

MD5
04b92c8a8d39f41c47c650f5da488cd2

SHA1
2eb45dbfa02f6834754c5c7a1bf78502619b209b

SHA256
5c562307e5ec669c9d527fe1946f78e20de556000a5ef2106b05bb289387dd8c

SHA512
32eae25f9ea10b350843e44319cc89e815062d57abca874fab545f91bbd6ab95e8778d011d1ea118c51d601be7639a1e069a0c871c104e2c6c19c351d8f2b230

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe

Filesize
468KB

MD5
14169e03be4027e60e8678d3ae084abf

SHA1
d59416b4e668a705082ef7492377ba7a7a02cfb6

SHA256
fc9c2c5bab5b18d5c016f23918a147d6f224cc22d4050204d70fec23226b73a6

SHA512
7b0ee66e7795efd00ffcbdd046508f795c693f57596b69a23fbda842456f5d04d73d8787172f7db92c0f4a2c1e9e38bb97b6248503877dbd22ddf189c01e522c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe

Filesize
468KB

MD5
80024f6c00c4cad9ab6e0ab9f79dc886

SHA1
e3e5c5dd0fa3c1540a74f7793ccaba812012c271

SHA256
386f9c8aac6d3a7ad1f60fb1170cd419515e75bcf8f6296dc19d3241d0284614

SHA512
1ab0f846b522dd3b090c4ac4c676058b5c4b6789cd165b3ef10b0e201dfd3927f4fc232595343f979721c58fdc452ab89d0fa1abb41448f7292136b86e8387cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41834.exe

Filesize
468KB

MD5
bcb1981e294d76ff1b6ca171750c7bc5

SHA1
04d29f51940f6b7c95a16e365529074a128c928e

SHA256
df3fa179d99d26bee7e414a98d00f55049ed2ffe1f43c1876953a223f3db3c74

SHA512
97bfe5e5699ec2687e632e1a2cbd44522c93d198f931ae8301d8d63c34358b67942cfa1b137199e42858b063fbcd25e6cf26d88df4e55c936e913c7ab35936dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe

Filesize
468KB

MD5
705f9c20dadcff628ae9c2612ebf0c69

SHA1
f8777060884b67420ccf8e3311e98a732c689fd1

SHA256
c56552afad5835d166704f816b87a6937b502e79149040afb6f624bcdfde9e3c

SHA512
92ed78f4793d4aeaf0def818afccda5cc2e9ad9d0be8be18b9dfdd6b41f56d859f979e96e78b338656d35e21779dc2f2f25c14578e7874d634bf5b2ff12a2edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4699.exe

Filesize
468KB

MD5
507cf71d8d51406fa0ced11933597aad

SHA1
87ebf8f4ecb0c22dd8080af842646ce804514072

SHA256
fa0998129548882f7f10bea00cc978e3b31788493c960ba10a889ec3c53a57c7

SHA512
88cf56a90fe74143ea0564ee2931c318ca6cd55180ab841ae6ba7d80a86d2925d200a4e3f158507c82a556257504eaed731e6baf96d3079d2a19b1e9bfadf299

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe

Filesize
468KB

MD5
64406a441622b1b4693214438a79d8c7

SHA1
84c34de88e5ed5cab60cb241e56d803a213d17c1

SHA256
02ce4d70be6c3d19aa4578606c765325e4ca3b2ac7be1ba8c5f604ec732becac

SHA512
4a8fbe7954fb5dc7f58557d30eb2054a0f9086c9904435a88dd9ba0718b90880ed53295459501a74f9d6a74d2f284dccc7d92030453878fea1848f525e641cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48799.exe

Filesize
468KB

MD5
026b0f92cd8ea4c271424cfa4a3fe878

SHA1
1eda630265d74a031fe5733d53aecbab872bd0d0

SHA256
b0e6186c62460cb58c16d09b4814889aaef91ed673fb203dc8ab3eedbe3f8cc3

SHA512
15efab5286e2d8b8f7c4b19ee3b8038e7a78e9d4b30be94ece6db4b44497f3e223dccc45c2b323047e7a5e2d01d20d635d336e7014a5e3e5eca2d9c16c425348

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe

Filesize
468KB

MD5
30692652b82fa2d374dd05ed0c48c914

SHA1
b7221f8a3ead5df00dc38d177de2084071953aee

SHA256
74311984df822c9fef5d6dc1b75eb25501b1a853b1198f9f2f1d3f0e9a3bedf2

SHA512
4f8bd8713662d1a1b280db3cb23afc94cb8b23a9ba2b10696933d937637d3d39d01c5b209e09c4b882a40ec7858a66b2567da8bc7177275b55d319c664da0353

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe

Filesize
468KB

MD5
c1701645f6fdd520a6501c43998557fb

SHA1
d6ed921236f357d7b51e1352b01b12a24bfd9ae8

SHA256
9a1a5055e43c74bc6a64d30ec6e044b2e2722231ddfd6edd4625a294ff219287

SHA512
c0a65ea9295fd7d5d568ef5733e6760975274cf26f0ce64e7ef943da83d5159df28e1d12a856251168f51ed36ca84d4ba95df4763156086bc503d024f5780b20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe

Filesize
468KB

MD5
544a4fb616b5be9ebe78d29f2afc5fb3

SHA1
0bc9fd61e140fe57624d52975ab35cd812cf2a59

SHA256
38bb4e522f8638216c077d983f7cde981d4b5f0f5561a6478b6f0ec89445b6d7

SHA512
4bf2bd8f2781f8845180b54377eb9afed6a1db9e6a852c5b3f6012a81c51552dbb5467ef975f6cc66b48998e344978ad1bb2e29a5224d614b7c160f920882ae1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe

Filesize
468KB

MD5
732943b6384b02d755be99fdad4b8bf7

SHA1
46073e5c8606cfc404599ff8d784cc874005eb5b

SHA256
855e98b6b5ac67311702ef6aa6a7ef2221fcf8ef6c6e04d682219554939fb45f

SHA512
f57e9080793bb93be467fc543942bcd336f1b3c267725f55665d028a470865084e90a20e147ed4a8050187dd612408dc6df4338ae870815fc41f3ef5ebe4f080

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59432.exe

Filesize
468KB

MD5
858e5c84d72ba60c7c5785dc700047b1

SHA1
17f7540708fb555072791f51028f117af1b507fa

SHA256
d3d6a2822007dd56682f9f2801e34f642e31e04437d5fe92ec20f0ac82b2aa7a

SHA512
c847695c178bc6c8c8f1d58f6a57f8eba693afd269ed1578ebf6ffe5e0720cfb5fac79659ea3398003fee2a6a74621a6118f26fb5970d7fd1dc05d77041897fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59654.exe

Filesize
468KB

MD5
a19f25a98feeda743a0f12a73ea2fa59

SHA1
c66c60cfef06dc2803e1baec31372739db510e8a

SHA256
d0aa5e19b5bcab715c670b3c459615ff1c35fe3d72581a1883ce03db0c08cde8

SHA512
7d706caa04868c36f367a1aa104d9eaacb840e64935a3fcfe6b2b6bb4a406dd1a7e64b378df5d98690c7271b9b60bfbae62a872b96bfcf52803d71138e6148ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe

Filesize
468KB

MD5
490784654259f10a1978ef13a703fc36

SHA1
5afa824405469e45ae90788a568d7f03ea5f5ec8

SHA256
ebd82ce4d3f8e6b35b0281d75a274a77bfed71c5ec23b1a28f2d071eeb01a97b

SHA512
a55c46c2e2581e8b54eb336e01122b8a171ba8b35f946adcf7d7b150126a99290e8c36ab0e495d7b81bbb39c84e9ad990161b612c849ac4295bcc7e10e03b37b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exe

Filesize
468KB

MD5
2c53f37cab3937755cb190a8d6903ce4

SHA1
367df483ca2f09ff16f5d84e062c420030e6e018

SHA256
550ed0c986cf09ebe60f7382fd931c57238a7f4e55e4bae09f9f0f3010f84538

SHA512
160972a19acb384b952ef4491cf61e164efd9535e9818c01ee73dbaef68fb46e4bdd5c2125edc71c65cc80c155629f92c1e4ca305bfd692452f03c0b0bd646fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe

Filesize
468KB

MD5
9abd26b170432552335916c43874b78b

SHA1
e2709637c11294fe529a22c0bdf75e18a658b79e

SHA256
eee5c386a8d8032d94fa58887fb01fa8f1c6a6dfd51e6b89704c51dd113df9a3

SHA512
6d49c3fc401a7278e2d89f9ae429e6a04b11becf0350e7337b56faae5ca205c07f70adc7c8f10b106a039461dbe3d29c80e8740ad445076c3bdefba6b7bdb71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe

Filesize
468KB

MD5
169ea3c8b4a856aa5ffe5a01b13edc90

SHA1
24e78a3d93a5083b86161e4577c60ac33e428a79

SHA256
30e4d25e839c7db6e4efc92366e1f929eb1e8c6fee975d38a69ef55ad37a6477

SHA512
6ee61dc4d95ea1341c1907be7fe4d45f1a7f2480be48856c4603ee4dbaebab8201668fe5f513e8efcac2e8fa01f3e33fda78bdf43c3a4ac4b28979055dbd08c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe

Filesize
468KB

MD5
94432274f84c0e8d0b24d5796dd06c46

SHA1
1ea9b9add4e8c477c0e2bbcf23b1b14abd009f43

SHA256
5409200eccaccf317724c8df08b363c451e01a8e5a02f4dcda47a5267d7b94ad

SHA512
9af550a8976175e6153b6e226a99ecb639a7f9dfaf808b4ddd01fbc9938949fdfee75e0eaad028ac2622c73499c9b6df86d63927045395b68ac7c47696ab7b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe

Filesize
468KB

MD5
0c1f2c555c5b856bfd9aaffb467bd0b3

SHA1
60e2beafd8e4725a711b86de8c371ccbb2de60de

SHA256
bfec53d9c903cc85ee7e00196f5f28e18d9b82962a9ba0a664e679c5d721b60f

SHA512
309534d26979baf6cdfa707641f61c0392b430b04566d335cbfd60a834246a427c1290a71cad9f25a8de839ecb0f730fdb31e1acb5d9204ed84bbbf5218b6bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64964.exe

Filesize
468KB

MD5
ea419d6b47b4614744fbd78a028423ed

SHA1
6affa7e14a2a6e62aa1184aec86f1e3d1efb2bef

SHA256
0951f217eba7002ea8580d1ccd234e55813af82e90778bf8d84397a149d5ac29

SHA512
29629cb1528966992ad78bf58f41c44e85e6ce2ca53ab4104a2bf76aedf845019fc36aa0241b5a6366ca2c51c513df7fe2b7b577c73bcf19dba94ed386340d15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe

Filesize
468KB

MD5
6f8584b8f8318a689c707f3d638bfe27

SHA1
e74e3c886b22d57579ce21f40bebe99a57b85e18

SHA256
88f90ec16b8986a88e23e1a0760bd64dcbdd20eeb71025fb259a6712a5db875b

SHA512
bef16305ca4cd207317f40257895157d8136d38a485d78a734efc304477da4a3a5a2d1a195f7c87dee9ce54d964d841a5543f1c3e544481f74f58b1298c4196a

Download Submit
memory/396-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/548-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/624-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/724-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/852-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1020-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1036-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1172-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1180-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1300-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1600-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1896-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2116-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2156-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2832-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3088-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3108-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3228-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3340-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3344-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3412-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3628-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3876-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3964-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4172-3019-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4224-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4248-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4492-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4608-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4648-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4704-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4736-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4824-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-2851-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5124-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5148-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5236-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5312-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-925-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-926-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-927-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5444-928-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5524-929-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5532-930-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5544-932-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5572-933-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5580-943-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5652-931-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5680-936-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5712-935-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5744-944-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14068-3017-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14520-3043-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14636-3016-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14736-2946-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14752-3015-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15432-2997-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15752-2572-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15836-3018-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15848-2996-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16168-2590-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads