0d40f3909e834ae316d61041e84cdf38e4c5fc8a7132c51003a142be460cb141

Analysis

max time kernel
120s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af6fb8d969ad830c655c98adfaac1990N.exe
Size

468KB
MD5

af6fb8d969ad830c655c98adfaac1990
SHA1

741f57eb62e57457cb78355a8b6de6c517a652b3
SHA256

0d40f3909e834ae316d61041e84cdf38e4c5fc8a7132c51003a142be460cb141
SHA512

d197995da4355e1ea232093e539fe1264018a24d8b86d4cd9f819703b6ed56b6a2a47f06da6fd8c5bc9bb43e59421405aab9f1525388cf7b13fc0630d1d0c4f5
SSDEEP

3072:tvzDog5WET882bYKWbi/lf8/3fdEtIpyndHDsVKKN/838QLNz7l8:tvfo6g82tWW/lfp0AyN/SxLNz

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3084	Unicorn-7557.exe
1836	Unicorn-18186.exe
5080	Unicorn-2404.exe
4120	Unicorn-1029.exe
1344	Unicorn-1029.exe
5112	Unicorn-54869.exe
4800	Unicorn-3067.exe
4112	Unicorn-64366.exe
2500	Unicorn-11828.exe
2356	Unicorn-7189.exe
4792	Unicorn-19442.exe
1616	Unicorn-59825.exe
1636	Unicorn-64174.exe
552	Unicorn-58044.exe
1540	Unicorn-44309.exe
2680	Unicorn-26982.exe
2464	Unicorn-59462.exe
2652	Unicorn-23068.exe
4104	Unicorn-42934.exe
448	Unicorn-55186.exe
1512	Unicorn-40696.exe
4408	Unicorn-26960.exe
4612	Unicorn-35128.exe
1624	Unicorn-46826.exe
2204	Unicorn-26406.exe
4352	Unicorn-37895.exe
3704	Unicorn-8023.exe
2352	Unicorn-40172.exe
2508	Unicorn-59773.exe
2112	Unicorn-6753.exe
4836	Unicorn-60038.exe
2728	Unicorn-24974.exe
1312	Unicorn-54309.exe
1100	Unicorn-49286.exe
1784	Unicorn-37588.exe
4144	Unicorn-33718.exe
3644	Unicorn-26702.exe
1184	Unicorn-2197.exe
3816	Unicorn-65496.exe
3232	Unicorn-10173.exe
4972	Unicorn-62809.exe
2452	Unicorn-43208.exe
5064	Unicorn-18150.exe
840	Unicorn-2368.exe
4912	Unicorn-18150.exe
2588	Unicorn-9981.exe
4156	Unicorn-34848.exe
696	Unicorn-22042.exe
4460	Unicorn-26126.exe
1000	Unicorn-36332.exe
3952	Unicorn-41692.exe
1568	Unicorn-32108.exe
1808	Unicorn-26126.exe
3708	Unicorn-17255.exe
4248	Unicorn-51974.exe
3308	Unicorn-47293.exe
4980	Unicorn-18539.exe
4236	Unicorn-27205.exe
3596	Unicorn-21339.exe
1204	Unicorn-15772.exe
208	Unicorn-35638.exe
4676	Unicorn-35638.exe
4468	Unicorn-7817.exe
4360	Unicorn-15986.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
9872	6352	WerFault.exe	241
10004	8596	WerFault.exe	395
16136	14108	WerFault.exe	676
8264	4624	WerFault.exe	809

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18807.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15764	dwm.exe
Token: SeChangeNotifyPrivilege	15764	dwm.exe
Token: 33	15764	dwm.exe
Token: SeIncBasePriorityPrivilege	15764	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2692	af6fb8d969ad830c655c98adfaac1990N.exe
3084	Unicorn-7557.exe
5080	Unicorn-2404.exe
1836	Unicorn-18186.exe
4800	Unicorn-3067.exe
1344	Unicorn-1029.exe
4120	Unicorn-1029.exe
5112	Unicorn-54869.exe
4112	Unicorn-64366.exe
2500	Unicorn-11828.exe
4792	Unicorn-19442.exe
2356	Unicorn-7189.exe
1616	Unicorn-59825.exe
1636	Unicorn-64174.exe
1540	Unicorn-44309.exe
552	Unicorn-58044.exe
2680	Unicorn-26982.exe
2464	Unicorn-59462.exe
2652	Unicorn-23068.exe
448	Unicorn-55186.exe
4104	Unicorn-42934.exe
1512	Unicorn-40696.exe
1624	Unicorn-46826.exe
2204	Unicorn-26406.exe
4408	Unicorn-26960.exe
4612	Unicorn-35128.exe
3704	Unicorn-8023.exe
4352	Unicorn-37895.exe
2508	Unicorn-59773.exe
4836	Unicorn-60038.exe
2352	Unicorn-40172.exe
2112	Unicorn-6753.exe
2728	Unicorn-24974.exe
1312	Unicorn-54309.exe
1784	Unicorn-37588.exe
1100	Unicorn-49286.exe
4144	Unicorn-33718.exe
3644	Unicorn-26702.exe
1184	Unicorn-2197.exe
3816	Unicorn-65496.exe
3232	Unicorn-10173.exe
4972	Unicorn-62809.exe
2452	Unicorn-43208.exe
5064	Unicorn-18150.exe
840	Unicorn-2368.exe
4156	Unicorn-34848.exe
4912	Unicorn-18150.exe
696	Unicorn-22042.exe
2588	Unicorn-9981.exe
4460	Unicorn-26126.exe
4980	Unicorn-18539.exe
3952	Unicorn-41692.exe
4248	Unicorn-51974.exe
1000	Unicorn-36332.exe
3308	Unicorn-47293.exe
3708	Unicorn-17255.exe
1568	Unicorn-32108.exe
4676	Unicorn-35638.exe
4236	Unicorn-27205.exe
1204	Unicorn-15772.exe
3596	Unicorn-21339.exe
208	Unicorn-35638.exe
1808	Unicorn-26126.exe
2300	Unicorn-15986.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3084	2692	af6fb8d969ad830c655c98adfaac1990N.exe	89
PID 2692 wrote to memory of 3084	2692	af6fb8d969ad830c655c98adfaac1990N.exe	89
PID 2692 wrote to memory of 3084	2692	af6fb8d969ad830c655c98adfaac1990N.exe	89
PID 3084 wrote to memory of 1836	3084	Unicorn-7557.exe	92
PID 3084 wrote to memory of 1836	3084	Unicorn-7557.exe	92
PID 3084 wrote to memory of 1836	3084	Unicorn-7557.exe	92
PID 2692 wrote to memory of 5080	2692	af6fb8d969ad830c655c98adfaac1990N.exe	93
PID 2692 wrote to memory of 5080	2692	af6fb8d969ad830c655c98adfaac1990N.exe	93
PID 2692 wrote to memory of 5080	2692	af6fb8d969ad830c655c98adfaac1990N.exe	93
PID 1836 wrote to memory of 4120	1836	Unicorn-18186.exe	95
PID 1836 wrote to memory of 4120	1836	Unicorn-18186.exe	95
PID 1836 wrote to memory of 4120	1836	Unicorn-18186.exe	95
PID 5080 wrote to memory of 1344	5080	Unicorn-2404.exe	96
PID 5080 wrote to memory of 1344	5080	Unicorn-2404.exe	96
PID 5080 wrote to memory of 1344	5080	Unicorn-2404.exe	96
PID 3084 wrote to memory of 5112	3084	Unicorn-7557.exe	98
PID 3084 wrote to memory of 5112	3084	Unicorn-7557.exe	98
PID 3084 wrote to memory of 5112	3084	Unicorn-7557.exe	98
PID 2692 wrote to memory of 4800	2692	af6fb8d969ad830c655c98adfaac1990N.exe	97
PID 2692 wrote to memory of 4800	2692	af6fb8d969ad830c655c98adfaac1990N.exe	97
PID 2692 wrote to memory of 4800	2692	af6fb8d969ad830c655c98adfaac1990N.exe	97
PID 1344 wrote to memory of 4112	1344	Unicorn-1029.exe	101
PID 1344 wrote to memory of 4112	1344	Unicorn-1029.exe	101
PID 1344 wrote to memory of 4112	1344	Unicorn-1029.exe	101
PID 5080 wrote to memory of 2500	5080	Unicorn-2404.exe	102
PID 5080 wrote to memory of 2500	5080	Unicorn-2404.exe	102
PID 5080 wrote to memory of 2500	5080	Unicorn-2404.exe	102
PID 4800 wrote to memory of 2356	4800	Unicorn-3067.exe	103
PID 4800 wrote to memory of 2356	4800	Unicorn-3067.exe	103
PID 4800 wrote to memory of 2356	4800	Unicorn-3067.exe	103
PID 5112 wrote to memory of 4792	5112	Unicorn-54869.exe	104
PID 5112 wrote to memory of 4792	5112	Unicorn-54869.exe	104
PID 5112 wrote to memory of 4792	5112	Unicorn-54869.exe	104
PID 2692 wrote to memory of 1616	2692	af6fb8d969ad830c655c98adfaac1990N.exe	105
PID 2692 wrote to memory of 1616	2692	af6fb8d969ad830c655c98adfaac1990N.exe	105
PID 2692 wrote to memory of 1616	2692	af6fb8d969ad830c655c98adfaac1990N.exe	105
PID 4120 wrote to memory of 1636	4120	Unicorn-1029.exe	107
PID 4120 wrote to memory of 1636	4120	Unicorn-1029.exe	107
PID 4120 wrote to memory of 1636	4120	Unicorn-1029.exe	107
PID 3084 wrote to memory of 552	3084	Unicorn-7557.exe	106
PID 3084 wrote to memory of 552	3084	Unicorn-7557.exe	106
PID 3084 wrote to memory of 552	3084	Unicorn-7557.exe	106
PID 1836 wrote to memory of 1540	1836	Unicorn-18186.exe	108
PID 1836 wrote to memory of 1540	1836	Unicorn-18186.exe	108
PID 1836 wrote to memory of 1540	1836	Unicorn-18186.exe	108
PID 4112 wrote to memory of 2680	4112	Unicorn-64366.exe	109
PID 4112 wrote to memory of 2680	4112	Unicorn-64366.exe	109
PID 4112 wrote to memory of 2680	4112	Unicorn-64366.exe	109
PID 2500 wrote to memory of 2464	2500	Unicorn-11828.exe	110
PID 2500 wrote to memory of 2464	2500	Unicorn-11828.exe	110
PID 2500 wrote to memory of 2464	2500	Unicorn-11828.exe	110
PID 1344 wrote to memory of 2652	1344	Unicorn-1029.exe	111
PID 1344 wrote to memory of 2652	1344	Unicorn-1029.exe	111
PID 1344 wrote to memory of 2652	1344	Unicorn-1029.exe	111
PID 1616 wrote to memory of 4104	1616	Unicorn-59825.exe	112
PID 1616 wrote to memory of 4104	1616	Unicorn-59825.exe	112
PID 1616 wrote to memory of 4104	1616	Unicorn-59825.exe	112
PID 2356 wrote to memory of 448	2356	Unicorn-7189.exe	113
PID 2356 wrote to memory of 448	2356	Unicorn-7189.exe	113
PID 2356 wrote to memory of 448	2356	Unicorn-7189.exe	113
PID 5080 wrote to memory of 1512	5080	Unicorn-2404.exe	114
PID 5080 wrote to memory of 1512	5080	Unicorn-2404.exe	114
PID 5080 wrote to memory of 1512	5080	Unicorn-2404.exe	114
PID 4800 wrote to memory of 4408	4800	Unicorn-3067.exe	115

C:\Users\Admin\AppData\Local\Temp\af6fb8d969ad830c655c98adfaac1990N.exe
"C:\Users\Admin\AppData\Local\Temp\af6fb8d969ad830c655c98adfaac1990N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7557.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7557.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe
        8⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27442.exe
        9⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15324.exe
        9⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        9⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1851.exe
        8⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58170.exe
        8⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
        8⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36458.exe
        8⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12868.exe
        9⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24679.exe
        8⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        8⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51027.exe
        8⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
        7⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55698.exe
        8⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        8⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exe
        7⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        7⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        7⤵
        
        PID:16776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32108.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
        9⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        9⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17070.exe
        9⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
        8⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        8⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        8⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        8⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63279.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40529.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        7⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
        7⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
        6⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6393.exe
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54122.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        6⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62600.exe
        6⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35166.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38238.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        9⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        9⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61629.exe
        8⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
        8⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
        7⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        8⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        8⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30474.exe
        8⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17795.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
        7⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41767.exe
        7⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58378.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
        8⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe
        8⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10054.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        7⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        7⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13519.exe
        6⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42605.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        6⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        7⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
        7⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
        6⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34925.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        5⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        6⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14644.exe
        6⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
        6⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36567.exe
        5⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62955.exe
        5⤵
        
        PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9981.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29966.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42514.exe
        8⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        9⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe
        9⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34420.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
        8⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        8⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38085.exe
        8⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        8⤵
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38652.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        7⤵
        
        PID:180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60993.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
        8⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe
        8⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        7⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42588.exe
        7⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33477.exe
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33327.exe
        6⤵
        
        PID:14932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30791.exe
        6⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47293.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        8⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        8⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        8⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43897.exe
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31555.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30336.exe
        7⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13816.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
        6⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        6⤵
        
        PID:11140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        5⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31106.exe
        7⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
        7⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
        6⤵
        
        PID:11472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4480.exe
        6⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        6⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29857.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-255.exe
        5⤵
        
        PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45889.exe
        5⤵
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35358.exe
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28918.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55594.exe
        8⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
        9⤵
        
        PID:16508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        8⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        8⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        7⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22264.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9670.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        6⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
        6⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60993.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
        6⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55698.exe
        7⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        7⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
        7⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46112.exe
        6⤵
        
        PID:13016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27980.exe
        6⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40344.exe
        5⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1627.exe
        5⤵
        
        PID:9228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27205.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        7⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65311.exe
        7⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        6⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55032.exe
        6⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18860.exe
        5⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27738.exe
        6⤵
        
        PID:12760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
        6⤵
        
        PID:16680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        5⤵
        
        PID:10840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
        5⤵
        
        PID:15136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14644.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35956.exe
        5⤵
        
        PID:7588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
      4⤵
      PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4101.exe
      4⤵
      PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37340.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46826.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        8⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
        9⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        9⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17070.exe
        9⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe
        8⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18807.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33637.exe
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4968.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        8⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25691.exe
        8⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        8⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34925.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe
        7⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
        6⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        8⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
        8⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        8⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4836.exe
        7⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        7⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        7⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        6⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3077.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        7⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        7⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44281.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3483.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        6⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2368.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13245.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11813.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        8⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51614.exe
        9⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        9⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        9⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29636.exe
        8⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe
        8⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
        7⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        7⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
        7⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        7⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        7⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33607.exe
        6⤵
        
        PID:13580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
        6⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12315.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        7⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56428.exe
        7⤵
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62448.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
        6⤵
        
        PID:8248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34185.exe
        5⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22834.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22968.exe
        6⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
        5⤵
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35136.exe
        5⤵
        
        PID:14756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        5⤵
        
        PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63562.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36458.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        8⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        8⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
        8⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32849.exe
        7⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60505.exe
        7⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63350.exe
        7⤵
        
        PID:17460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        6⤵
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52019.exe
        6⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53401.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
        6⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43315.exe
        7⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14644.exe
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        6⤵
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        6⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
        5⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe
        5⤵
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        6⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        7⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe
        7⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        6⤵
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        6⤵
        
        PID:16752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe
        5⤵
        
        PID:16796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        5⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        6⤵
        
        PID:17496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47612.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10491.exe
        5⤵
        
        PID:9928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
      4⤵
      PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
      4⤵
      PID:11764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
      4⤵
      PID:7568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        8⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49220.exe
        8⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53139.exe
        7⤵
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
        7⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        7⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62187.exe
        7⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3579.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14078.exe
        6⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19663.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        6⤵
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15919.exe
        6⤵
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29289.exe
        5⤵
        
        PID:8808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59892.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        5⤵
        
        PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15772.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe
        5⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16040.exe
        7⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        7⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21643.exe
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64037.exe
        6⤵
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe
        6⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30072.exe
        6⤵
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48975.exe
        6⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18807.exe
        5⤵
        
        PID:13396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5107.exe
      4⤵
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
        5⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        6⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8596 -s 464
        7⤵
        Program crash
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        6⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65503.exe
        6⤵
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46829.exe
        5⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19235.exe
        5⤵
        
        PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
      4⤵
      PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19814.exe
        5⤵
        
        PID:13008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
        5⤵
        
        PID:15820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
      4⤵
      PID:10404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
      4⤵
      PID:14960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26583.exe
      4⤵
      PID:4160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21607.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        7⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
        6⤵
        
        PID:12732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
        6⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14096.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        6⤵
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8710.exe
        6⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe
        5⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63809.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7411.exe
      4⤵
      PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        5⤵
        
        PID:10256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63339.exe
        5⤵
        
        PID:9688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
      4⤵
      PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8061.exe
        5⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
        6⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
        5⤵
        
        PID:13456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56760.exe
        5⤵
        
        PID:16568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
      4⤵
      PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        5⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12986.exe
        5⤵
        
        PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
      4⤵
      PID:10892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-197.exe
      4⤵
      PID:720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51885.exe
    3⤵
    PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
      4⤵
      PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        5⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3404.exe
        5⤵
        
        PID:14296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50895.exe
        5⤵
        
        PID:16544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
      4⤵
      PID:10676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43144.exe
      4⤵
      PID:15212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
      4⤵
      PID:7460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
    3⤵
    PID:8060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12939.exe
    3⤵
    PID:7404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6992.exe
    3⤵
    PID:14680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2404.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2404.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        7⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15513.exe
        8⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        9⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47582.exe
        10⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48338.exe
        10⤵
        
        PID:17472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        9⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        9⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22936.exe
        9⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60337.exe
        8⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56263.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        7⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
        8⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        8⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5778.exe
        8⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1851.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        7⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
        6⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10685.exe
        9⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2567.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        8⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        8⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47440.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52493.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60270.exe
        8⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
        8⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49009.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55879.exe
        7⤵
        
        PID:16608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
        7⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57580.exe
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12220.exe
        6⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54309.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe
        6⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14361.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65046.exe
        8⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
        9⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        9⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        9⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20928.exe
        8⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        8⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
        8⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        8⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2995.exe
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
        7⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        7⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7411.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
        7⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1484.exe
        7⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62763.exe
        7⤵
        
        PID:16812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        6⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
        6⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
        5⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
        7⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
        7⤵
        
        PID:16764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47396.exe
        6⤵
        
        PID:14200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        6⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33313.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
        6⤵
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41959.exe
        6⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
        5⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
        5⤵
        
        PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15601.exe
        6⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe
        8⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47530.exe
        9⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        9⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59221.exe
        9⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe
        8⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        8⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2323.exe
        8⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36740.exe
        7⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        7⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
        7⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60145.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        7⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
        7⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        6⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe
        7⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
        6⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        6⤵
        
        PID:17660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
        5⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exe
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27022.exe
        8⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        8⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        7⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        7⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14846.exe
        7⤵
        
        PID:16640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        6⤵
        
        PID:14824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63279.exe
        6⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5683.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14613.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
        6⤵
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50895.exe
        6⤵
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        5⤵
        
        PID:12740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1627.exe
        5⤵
        
        PID:8572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65496.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        5⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        6⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        8⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        8⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10560.exe
        7⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        7⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        7⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6371.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        6⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18240.exe
        6⤵
        
        PID:17636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9052.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5656.exe
        6⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        6⤵
        
        PID:16168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52562.exe
        6⤵
        
        PID:17892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe
        5⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18396.exe
        5⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
        5⤵
        
        PID:9304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61989.exe
      4⤵
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-713.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        6⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
        7⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29636.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54472.exe
        6⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34420.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40624.exe
        5⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
        5⤵
        
        PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
      4⤵
      PID:6352
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 636
        5⤵
        Program crash
        
        PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48052.exe
      4⤵
      PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
      4⤵
      PID:12584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
      4⤵
      PID:16920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59462.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49286.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59108.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe
        8⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        8⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        8⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5936.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57152.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        7⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2937.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        7⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        7⤵
        
        PID:17904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1851.exe
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30841.exe
        6⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
        5⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55594.exe
        7⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        7⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
        7⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39159.exe
        6⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17935.exe
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
        7⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53652.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17296.exe
        6⤵
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
        6⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28920.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42727.exe
        6⤵
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        5⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        5⤵
        
        PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe
        5⤵
        Executes dropped EXE
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15706.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25514.exe
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        8⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        8⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        8⤵
        
        PID:17672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
        7⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
        6⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46937.exe
        7⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
        6⤵
        
        PID:12052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        6⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35026.exe
        6⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        7⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17960.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43144.exe
        6⤵
        
        PID:15160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
        6⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
        5⤵
        
        PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
        5⤵
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
      4⤵
      PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14361.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24014.exe
        6⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62974.exe
        7⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42037.exe
        7⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
        6⤵
        
        PID:13796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32064.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15247.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe
        5⤵
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        5⤵
        
        PID:17916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32545.exe
      4⤵
      PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
        5⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
        6⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58801.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        5⤵
        
        PID:14956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60844.exe
        5⤵
        
        PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21191.exe
      4⤵
      PID:8640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
      4⤵
      PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17262.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40696.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2197.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12477.exe
        5⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8305.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        7⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43232.exe
        7⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        7⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        7⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6371.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe
        6⤵
        
        PID:17932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53401.exe
        5⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59221.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31182.exe
        6⤵
        
        PID:17420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
        5⤵
        
        PID:8196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36731.exe
        5⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35643.exe
        5⤵
        
        PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62041.exe
      4⤵
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        6⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23004.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        6⤵
        
        PID:14916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
        6⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38660.exe
        5⤵
        
        PID:11980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        5⤵
        
        PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
      4⤵
      PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        5⤵
        
        PID:16580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
      4⤵
      PID:10748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40874.exe
      4⤵
      PID:15192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
      4⤵
      PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62809.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-713.exe
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        6⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        6⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48121.exe
        6⤵
        
        PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4836.exe
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        5⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
      4⤵
      PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        5⤵
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
        5⤵
        
        PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
      4⤵
      PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
      4⤵
      PID:13388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
      4⤵
      PID:16536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9515.exe
    3⤵
    PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8061.exe
      4⤵
      PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14561.exe
        5⤵
        
        PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
        5⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe
        5⤵
        
        PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
      4⤵
      PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
      4⤵
      PID:14244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14489.exe
      4⤵
      PID:5596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38148.exe
    3⤵
    PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
      4⤵
      PID:12356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
      4⤵
      PID:17684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41102.exe
    3⤵
    PID:10496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
    3⤵
    PID:14612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe
    3⤵
    PID:8
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3067.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3067.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
        6⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
        8⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62974.exe
        9⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        8⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        8⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23936.exe
        7⤵
        
        PID:15552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6061.exe
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        7⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
        7⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18807.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
        6⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58149.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11048.exe
        7⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
        7⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43120.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
        6⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43592.exe
        5⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23107.exe
        6⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44124.exe
        6⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exe
        5⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        5⤵
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59789.exe
        6⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52605.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56263.exe
        6⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
        5⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        6⤵
        
        PID:13984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exe
        6⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46584.exe
        5⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12148.exe
        5⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45407.exe
        5⤵
        
        PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52616.exe
      4⤵
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4605.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
        6⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        6⤵
        
        PID:10448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        6⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34306.exe
        6⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        5⤵
        
        PID:13952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        5⤵
        
        PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33697.exe
      4⤵
      PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        5⤵
        
        PID:9832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
        5⤵
        
        PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43356.exe
      4⤵
      PID:13280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53669.exe
      4⤵
      PID:16936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18150.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42322.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40706.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46638.exe
        7⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 472
        8⤵
        Program crash
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20299.exe
        6⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56061.exe
        6⤵
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46943.exe
        6⤵
        
        PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5485.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        6⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63033.exe
        6⤵
        
        PID:17648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40529.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
        5⤵
        
        PID:15564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45851.exe
        5⤵
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9492.exe
        5⤵
        
        PID:17624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7411.exe
      4⤵
      PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        5⤵
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9172.exe
        5⤵
        
        PID:17536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18843.exe
      4⤵
      PID:8824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
      4⤵
      PID:14212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28205.exe
      4⤵
      PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36332.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63025.exe
        5⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1851.exe
      4⤵
      PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36731.exe
      4⤵
      PID:12996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
      4⤵
      PID:7180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
    3⤵
    PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60962.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56533.exe
      4⤵
      PID:9812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
      4⤵
      PID:13364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43932.exe
      4⤵
      PID:16692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29795.exe
    3⤵
    PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24036.exe
    3⤵
    PID:10500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40874.exe
    3⤵
    PID:15220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49870.exe
    3⤵
    PID:7468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe
      4⤵
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12005.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        6⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        7⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        7⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
        6⤵
        
        PID:11832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49597.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65129.exe
        5⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44716.exe
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        5⤵
        
        PID:14848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63279.exe
        5⤵
        
        PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
      4⤵
      PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30336.exe
        5⤵
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
      4⤵
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
      4⤵
      PID:12792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34848.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14937.exe
      4⤵
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48665.exe
        6⤵
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28267.exe
        5⤵
        
        PID:11408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe
        5⤵
        
        PID:15840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
      4⤵
      PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
        5⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62187.exe
        5⤵
        
        PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40529.exe
      4⤵
      PID:9504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14108 -s 476
        5⤵
        Program crash
        
        PID:16136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
      4⤵
      PID:8692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47530.exe
      4⤵
      PID:11812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
      4⤵
      PID:15264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34366.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2308.exe
    3⤵
    PID:336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27506.exe
    3⤵
    PID:13556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51868.exe
    3⤵
    PID:17548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18150.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41834.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        5⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        6⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55951.exe
        7⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13876.exe
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42952.exe
        6⤵
        
        PID:14552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24088.exe
        6⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        5⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6371.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe
        5⤵
        
        PID:17512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        5⤵
        
        PID:12580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9827.exe
      4⤵
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
      4⤵
      PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
      4⤵
      PID:5756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64117.exe
    3⤵
    PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8061.exe
      4⤵
      PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7326.exe
        5⤵
        
        PID:17524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
      4⤵
      PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21607.exe
      4⤵
      PID:12672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5831.exe
      4⤵
      PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29471.exe
    3⤵
    PID:11412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
    3⤵
    PID:14644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9094.exe
    3⤵
    PID:5000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41692.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41692.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe
    3⤵
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
      4⤵
      PID:9372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
      4⤵
      PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7254.exe
      4⤵
      PID:9700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1851.exe
    3⤵
    PID:8444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
    3⤵
    PID:13968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22200.exe
    3⤵
    PID:7308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
  2⤵
  PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8985.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
    3⤵
    PID:12004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-768.exe
    3⤵
    PID:15484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-396.exe
    3⤵
    PID:1912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
  2⤵
  PID:772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
    3⤵
    PID:12364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
    3⤵
    PID:5624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
  2⤵
  PID:10420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
  2⤵
  PID:14820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2115.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2115.exe
  2⤵
  PID:16476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6352 -ip 6352
1⤵
PID:9744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 8596 -ip 8596
1⤵
PID:10044

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4624 -ip 4624
1⤵
PID:7972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exe

Filesize
468KB

MD5
4bf27e6fc1b9ecb94c4fc8b974208e6f

SHA1
1ce50a1c2d588ac44375251bc28c648369664772

SHA256
05ac8040cd7418e26f72590714a59cb0e412f2360177550d453006095f25144c

SHA512
a73a17b31ebf8a62c450d8d01cedbb149f43a5c147e57b77aeb070cb62431fafbe7e5783e85c2ee37724a2c066c99fe855538c07a937d1de12dbf0401c80db6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe

Filesize
468KB

MD5
65bd40db7ea993f8c3490c4903b85f96

SHA1
3d60741c160b65e0a4f8801cd23a4f0558976296

SHA256
7d9f4ac953d83db922e25aac4c9e570fbf0f948c30d6509bbacabe0983bd1cc6

SHA512
84992d46436b974cea2c1c286ec43b973a3d7c672b5b70e938b7a6865c4259670edea0ec6effb5d8e55e71799d3d8cbe5db29f7029bbcc3df050a615a00bfdaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe

Filesize
468KB

MD5
eb0ca9e5128e869c5db46aae90553691

SHA1
41466b59ab64463ab0d142ab2bcc7602d0f5ba46

SHA256
f6b9e66a410fdc156eaf69858445f26c767c3a1f814dde172eea736fdb52186b

SHA512
5ef0de7bb54c7cefb81abc5bf1102598f44746ae6399b519ea2dce8dbdc5ffc639444b4810fdeb36567d262120e640dc32565fc6ae487cd87a0dda59a4697051

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe

Filesize
468KB

MD5
3718304be8f35286f6980a38c89604fc

SHA1
80b8f1678e60812742eb1ca0f958e715fc034d86

SHA256
7fcfbac47952430071baf696d8f129e40977fcdc14ab865ed668964a64bc0248

SHA512
f50d3ab7dd4cdf1ee7a52e6f2575b2e7d5598626f8fc9620b0f7e7ccd88baa2da7acb73917808f13e4d5acff75f85448055236cb8f040104226fa0f760159cac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe

Filesize
468KB

MD5
908a481866ac29661b94bf9bbb49c4d9

SHA1
3af7956671691486776d7704bb6a6a9b6a2c38fd

SHA256
609bd98d65e27c83dfcf2afdd38ed161aec2674766596ba5d340f246472217b1

SHA512
83ae8e6e773f441e9c60650f1100fae93b184722f69125821bb00438cfa23a9bab78b5ee8ceaeab40925455cf6c7f80d6a7c2341bd15f20c098c826dec3a6394

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2404.exe

Filesize
468KB

MD5
64a7d4b1384374194765079b51f03593

SHA1
d426015f13fcb6a7b8ecb6715ea6530bc9402503

SHA256
3ef2ac03b33d2e6058401682caeb67235933fc03a35b21e35b85afeb8d3090e9

SHA512
60f94240020e2a2ecf2d0c33cc546cc30b7d5876356cd70cbb368d0fc642f89ab443f408b5f40d079dc008eaf8cea7afbc54d5252461ff593c5f8adf854df92f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe

Filesize
468KB

MD5
8fa9eaa198bcaa96def913ca7ba1df11

SHA1
bf5ff644712f9c15d0d8de6707706ec3a368d803

SHA256
c3e90f3b63f53daf7a844a731f5920fdba39b1ffa7124b24a082332a4bc1ec62

SHA512
b3a6b154879b015f032ed78f32c2a334c437bdc529f8b2de23e2e227b4438c5b2325c13d010343557a6f156783593833a1d2156d392320150e0ad7d921dec296

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe

Filesize
468KB

MD5
9d3c2c0fd3c010e2bcf8be780d74b234

SHA1
9ce787e1e47b6ad24963ef41e2dcdc94570fc49d

SHA256
a1a924fcc4d949c0237e62239a739ac3326f1216bf9345b99f966d6099a7b79c

SHA512
9273915bf794f1d059eea5ff4bf2936f85f9bd922472c90dd4baa4e0ea511ac27e8dcbe1617059e239908391e8edf09f9ff61c9532349703d6607ab9ec6babfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe

Filesize
468KB

MD5
1b51c9a1129c6286ff23307dfc4052d4

SHA1
63f1ff4cf2822009853b33c61b85a197237f8170

SHA256
6978f0f2fa9c71ee5b486c95607f153010452963c375829eb8f0a3766e2e181d

SHA512
b19a407c8beea5a7e362cb5ae1a6edfb931d36ed5ec9f684644ea07c1b5db4c91060b7681e8f080e565c37edbe66f8a64f62181134526123c395796d6caddf43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe

Filesize
468KB

MD5
56a6129f37b7d15d92b42de508a03907

SHA1
c6b3f1ace7cfbf45ac0b231e4ec8bad1b3ca9dc2

SHA256
76056e9e34666bbc9958ce5842d2fffb00a496564c69779cfdd818ec4e40f9fd

SHA512
bd286f29b2bc35706f276199f32c29b7f5807f875b1140e0efd82e5bc7711630f2d3c1b08bac955ad730bed37311ad5cc5529a2c74491232e8940986493962c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3067.exe

Filesize
468KB

MD5
3dc0ac10f89745c4f3ddf05a5dd03001

SHA1
fdcec3751f6a5dd9eb44b294972b26df0b5a2b8c

SHA256
95d951f05b82839a0e3fef3e9d32ab44597194a8862df87e92e8c2c74b647db7

SHA512
90afa50170bf847559d63b53cc094194c094fed9738c420eb3bb5bddfc3aec4b991ccd7777919ef73ecb046e9406f926161e3c8e21c52b15a98fb63994c88c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe

Filesize
468KB

MD5
f1130e2082ce13c8a3244fee8be73802

SHA1
389cdbd4d341b30e2104c15f659d03ed59a7edf7

SHA256
5c2a22e8948766fa46cd260d8777d07dcb3076486126324c82071b988ef85a1a

SHA512
a015fda27a835672b494cc5f038fbb30fbec516377002121a07d57f8b250ca3f03bd874b1720cae7aac790d580b28eeefb52f5f248bdbc0725afc8210e1e3c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe

Filesize
468KB

MD5
4a67ef00fdf35cb08e9f15090aa80bcc

SHA1
5cbd0481144ab00a36444ea69405bc0fc1f3dcb2

SHA256
76cbe64591113bb111eec113b71229736b8ca7b5feecfabfcb485fd1e24ff18e

SHA512
63bd09b5309f4111f82dbbdb5f3d833455c389dbf216d12e251e8cc531b5eb5d95a1e8c3dcfc13a84d2b6629bd3ef6ca961118c8cb3376c9c081c931160f2641

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe

Filesize
468KB

MD5
d6ec79606a66ea643ce32cfada4e000e

SHA1
27407a80512ca1dbf8e1c26c02536e51721a2d8d

SHA256
27644bccc925f2a2d426c68d549d7f02113187bb567c9e3286bfcd9a5f5000ca

SHA512
83d25dedec2d5cbe5424fad833e69be3bed3a9e3d691a5709496715234a0086e7325418441e93cf1ebcbf67369c7868dfb093afc07ff3a818fbb2cae42c85087

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40696.exe

Filesize
468KB

MD5
8d51eb3061f22d1a7c8da96f4f7bd4d8

SHA1
d5f1b1f693e978094930b7d3b65a38303c25fe2d

SHA256
19488d7d77d04703d00f4ffab416c3b2046fe5d53b482fec71713e7d7180943a

SHA512
72ad0e8323746a23cad2bd4db7ca616ff19cff64fc635ca87f99f0e60db1675c38d109c2ca31c4e9f75a526182e8cb5dcee03805ad6a288ee6bd0609fb05a6cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe

Filesize
468KB

MD5
3ca9c543974faed519262702b136a469

SHA1
3e3ff560cf15e5135479705d295cf50e2b6fbf6d

SHA256
6c032a1bd0a1014d2d378226ad2d8421d29d37d636bcfe9b4e08485da5acb5b5

SHA512
9ab440e5515e9d404cc1cca01fa3a5f26b558df438839a0d082ff5915dabaaf7308f223eaf3ce78b5357ea9b01efbc4b2a76e46cf191b04f0db3cd588ad2bf41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe

Filesize
468KB

MD5
afd4c0bc4d9fe1734f42e1b057ffb2d5

SHA1
7f912784dbb69967501d2040bb8a843477b43e7a

SHA256
e6e88aa8971fbe50bdc6b71521db0e3a9a6dd99c1b833c47657a1f596f310d34

SHA512
d125a1cea3047f19a9b4e37aa0cc7dc2e5791177c46f0a0de03947752584a057bbd49cdaac31514ee4cc5abc1941692f77ac47a9217b52b641e322409524f372

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46826.exe

Filesize
468KB

MD5
dfa95aa0ab1824d680fcd6ab5cc90216

SHA1
bd9b0f4cd27a1554bd42ecd55d86ee8dd8159eb3

SHA256
47875830653e4580cee5abf14edb9e8fc4a036ccc3fab32618c037d9b1dafda1

SHA512
c59b593546ff22200df92054e1891210fa65776ad641b4433389a3944b8a8a253431416ac29a1a5604571fa71bbc6202df2c3a68dc19974b3582ded2e973da3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe

Filesize
468KB

MD5
a494b7a4bffe5983b455edcb7415bdb8

SHA1
7afa6dcbff35f78c178078763f2010f4a0720f09

SHA256
a5ac9d7eada5c9997d8d750ecaca485f8eef001448fdf33790a97203ec7cc54b

SHA512
24db4a30b7a2db33e857e63d1dcebb1e252cb1d8e31d163eaf96cd5005e3208665e013a9f95af45b3475660f04f00f754176dca86076a9fc866655ed026037bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55186.exe

Filesize
468KB

MD5
f3b174b132d387240e676654440cb7e1

SHA1
a2a5d58e18e36d84c1c35b63d2972d89ba70f61a

SHA256
c4a3716ad01dff447d6a3db0a521e020ed6c2c4ef997827f5a224ec0279704e3

SHA512
cda026fd69bcb560524fc68f1345213109180bb28a4aff7a88d2c02a203aaec16ebffcdafb80d11bae3dec70136167d51bcb32db6379669a19487ca594d6a224

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe

Filesize
468KB

MD5
b5c3cf7c9ed4f6d12cda2914a5efb8fa

SHA1
21816ee54802058d44adb9f90759791ef77252a1

SHA256
78916b22ecb05340a87e4100906593579cab06aecc5c98fab17151289034d590

SHA512
2f2797c61171a75594417ecaf28a176cbd47b02b2f6b2a7a1b3c808f82661ddb7f01b38f6fea92e95d5cc2afb9fd58bdd0c59d8a05d71ee969f20d16517201c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59462.exe

Filesize
468KB

MD5
45dff4d5f4774c4c2fc3fb2bbe1022ca

SHA1
08f030c41abd373ebc831cf0fec9208ea754fa4d

SHA256
b4b1a4dac790ea8404db28e03e654b426a41943f444f9478591b294502beda2c

SHA512
ce6a12a56b9bfbe66589c14f94f69d78544b5c5bd4baf2b88f8161e2aaf26b778dfa85d6b5bcbec40e391f5fca3b7718a3fe1d75a6556002a3947ac72a8e0b40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe

Filesize
468KB

MD5
a704737d43a639500be9945d822173d6

SHA1
04b834e31c1ff96c72b3b555f01a04e098d7f443

SHA256
8a745e16e64ae63963eb8a830f17fc56ae2d228fda2e32c6eb1b001d53fcc79a

SHA512
6b017da3f117aeaec3388dd045a06db944e77d91e55dc749ed427f71ab948aae19e567d87a3c0a295c596e1d254e77abaf4274462e2a32fb77393b14b89d163c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe

Filesize
468KB

MD5
c8b7c9364b09629f7d063d8ca234661e

SHA1
fea8a0e39185d98e566aab77deac2fd66e7a1143

SHA256
cfbd09d52de66569301d782db417f99c1c8dd56231306ca88537879b86b74de3

SHA512
8436c28f2bbbc7f9bfa8865585eceb2adbdd835b7afe42a4906a018145bf45b2967aab6cda161506528cda1bfec642f79d30528dbe68952768b8d67d8bf12405

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe

Filesize
468KB

MD5
c6c73e2b5171c0e60809cb770a6e6b14

SHA1
b607cfc80f13bded87f80ab4ff5f6c1e410c5b83

SHA256
2ca37bbbd1f558646dbeafef4fdfe7b179d9f278fcf09ec3f3495b793b770219

SHA512
7e2e7afcf781bf1db3f6e7ec97089528cc326e1b9fe2649258b1719b3c55502c055de67de2c55f1430b3e7e568d6392fe20bff074655aaad27155d36c7522456

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64174.exe

Filesize
468KB

MD5
85ea0aa33ddee5f795a1fb29bb00fa26

SHA1
951f5849933578bd32e7fb54534d71d4ffad4ccc

SHA256
fda1fdb67f02ef79121b5c49f445c1732aaf5ce12f9ed849e534cdade9e6b3e9

SHA512
8709e68776cd52f7b5900e809561d6545d15cb258fc99c20285fa29eb93afd9f6492fd2e070c6a25a38b0e4c59428dce5cb87e41970d27818e65fa281e3923b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe

Filesize
468KB

MD5
932b68256fc5c519474dc118d19deae9

SHA1
62f5605e1f3ca8ca66e2acbbc0b415774296dd6a

SHA256
456e2f12850cfbecc4c183541347548b3be221af6b9297ea2bd26b5509cc1b68

SHA512
69f80f74e979b9017f2f4649724eaf291ad45f9e642b55b4f553eaff0c25ad7a00c731f94d4120616407e78abad2a28883bc730dba427a7f2bec3082ecd57bff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe

Filesize
468KB

MD5
0d3c669f89f20ed5dddf2fceea9244d7

SHA1
c1902cc3f888459532a5eb16d124b07dca06df2c

SHA256
e141ba01d186abc57f18e89a4caa512f267cec4db6c8ef3c98d5cb13aa8a7663

SHA512
65be67ccccc75e944bfafb470a6fa7287231458223fe5fb1254f5ed216f01a63c6782a860e1caca83834f746ddd1df9a00452990b6e5d0f2c161434a28db9723

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe

Filesize
468KB

MD5
d38afb6c0b91b989de5ee195dedad835

SHA1
4e416bc4155d142e68c6f2f59ca992a4b08a0093

SHA256
db02ee71c1c1c4ad947ceaa1fa05c3e56e1468c6188eaec2d02d9bac07b7a261

SHA512
11b0e4f68c713c05707aaf018ac60189b38dc642d379b6d25e913c4ab308a936dad8d964047bb24ea5214214fdc1f42003c7e3050b688dd1453c5cea7bc09b08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7557.exe

Filesize
468KB

MD5
232727d8a508f071a1f95d2eca358d06

SHA1
aa8d6e9c50576743bdaa386ea0384e86b4989dec

SHA256
fdcafe93c971f9a97ac6e0aec046ee736abe9297bc930071d0a44d33b6f3eddf

SHA512
8fafe3a456a7dfdc7c845c3af57453c261d024014c75ff4685fa748dde66d1aee00912a48b56674b3bb3457e65aab9963ebb96a04d59031a17843c4e2ba077d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe

Filesize
468KB

MD5
bb5a48ca0f43f533d334b16591ff28fd

SHA1
69143472a7c37a95049e85b1d2e7d9804f77c014

SHA256
b8bff6a85ff4ffa52565807a816f4f507c230cbf8d3942a92cc00e0b34c96f99

SHA512
f4686f36801c4e070b8d5344e9d5e693ac0db5b34e3ca79bc502124e50e43c560a819b4b0bb79ea6513de81509d265f5ae3c98008958e5e2f5c2ab8ee5b09f9b

Download Submit
memory/208-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/552-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/696-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/836-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1000-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1100-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1184-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1204-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1312-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1344-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1496-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1512-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1540-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1624-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1784-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1808-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2204-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2464-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3084-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3248-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3300-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3704-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3760-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3816-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4104-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4112-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4120-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4156-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4248-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4612-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4644-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4792-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4800-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4888-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4980-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5064-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5076-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5192-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5476-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5488-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5504-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5584-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5724-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5744-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5772-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5784-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5796-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5832-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5840-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15484-2468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads