230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccb

Analysis

max time kernel
119s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe
Size

468KB
MD5

093693e8ca882ccd855a46d84bb8abd0
SHA1

a93df7446de10336ce926f3ad9394bf075c86ecf
SHA256

230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccb
SHA512

3e91312c7f570a0477dca36a8187cf4ff23a5438e46f04aedafd3861c4ae88f34cb71d425e46d6bce54b25dde1783795f6add632e7e435046354a70841b3a9c4
SSDEEP

3072:LGAwog5dP68U1bY0Pbijix8/3ChBb4BCndHeZVpn1dBgTIbNsElK:LG7omDU13PWjixBsBJ1dWEbNs

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4392	Unicorn-9262.exe
2020	Unicorn-18434.exe
1264	Unicorn-64629.exe
2328	Unicorn-5124.exe
3644	Unicorn-5648.exe
5012	Unicorn-65055.exe
1244	Unicorn-14096.exe
4340	Unicorn-49410.exe
3096	Unicorn-23924.exe
3424	Unicorn-43266.exe
3776	Unicorn-43266.exe
1512	Unicorn-23400.exe
2724	Unicorn-37381.exe
4264	Unicorn-31515.exe
1688	Unicorn-43266.exe
3632	Unicorn-52235.exe
3896	Unicorn-61207.exe
3032	Unicorn-7178.exe
3260	Unicorn-1708.exe
4636	Unicorn-10006.exe
864	Unicorn-29872.exe
5088	Unicorn-60427.exe
4428	Unicorn-60842.exe
3092	Unicorn-60842.exe
1584	Unicorn-35356.exe
820	Unicorn-25861.exe
3332	Unicorn-19730.exe
3620	Unicorn-11963.exe
4780	Unicorn-11310.exe
4480	Unicorn-34417.exe
2044	Unicorn-48153.exe
3940	Unicorn-39188.exe
232	Unicorn-51829.exe
676	Unicorn-184.exe
2980	Unicorn-59591.exe
3312	Unicorn-59406.exe
1804	Unicorn-53262.exe
3936	Unicorn-42088.exe
1600	Unicorn-4304.exe
4124	Unicorn-51476.exe
4900	Unicorn-25637.exe
2308	Unicorn-48051.exe
2792	Unicorn-45067.exe
4252	Unicorn-47880.exe
4824	Unicorn-41907.exe
3316	Unicorn-41907.exe
3392	Unicorn-35777.exe
3204	Unicorn-6328.exe
3420	Unicorn-8967.exe
3404	Unicorn-19060.exe
4668	Unicorn-275.exe
4604	Unicorn-26822.exe
2996	Unicorn-29357.exe
4364	Unicorn-9491.exe
1964	Unicorn-181.exe
3664	Unicorn-2994.exe
844	Unicorn-446.exe
1420	Unicorn-12916.exe
444	Unicorn-7316.exe
5044	Unicorn-46118.exe
4300	Unicorn-16398.exe
3668	Unicorn-55925.exe
4408	Unicorn-57358.exe
3976	Unicorn-18879.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
15620	6980	WerFault.exe	264
14864	15000	WerFault.exe	719
13264	17148	Process not Found	963
1736	17336	Process not Found	980
18324	17240	Process not Found	972

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23037.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15820	dwm.exe
Token: SeChangeNotifyPrivilege	15820	dwm.exe
Token: 33	15820	dwm.exe
Token: SeIncBasePriorityPrivilege	15820	dwm.exe
Token: SeCreateGlobalPrivilege	7864	dwm.exe
Token: SeChangeNotifyPrivilege	7864	dwm.exe
Token: 33	7864	dwm.exe
Token: SeIncBasePriorityPrivilege	7864	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe
4392	Unicorn-9262.exe
1264	Unicorn-64629.exe
2020	Unicorn-18434.exe
2328	Unicorn-5124.exe
3644	Unicorn-5648.exe
5012	Unicorn-65055.exe
1244	Unicorn-14096.exe
4340	Unicorn-49410.exe
4264	Unicorn-31515.exe
3424	Unicorn-43266.exe
3776	Unicorn-43266.exe
2724	Unicorn-37381.exe
3096	Unicorn-23924.exe
1688	Unicorn-43266.exe
1512	Unicorn-23400.exe
3632	Unicorn-52235.exe
3896	Unicorn-61207.exe
3032	Unicorn-7178.exe
3260	Unicorn-1708.exe
864	Unicorn-29872.exe
4636	Unicorn-10006.exe
4428	Unicorn-60842.exe
1584	Unicorn-35356.exe
820	Unicorn-25861.exe
3332	Unicorn-19730.exe
2044	Unicorn-48153.exe
4480	Unicorn-34417.exe
3092	Unicorn-60842.exe
3620	Unicorn-11963.exe
4780	Unicorn-11310.exe
5088	Unicorn-60427.exe
3940	Unicorn-39188.exe
2980	Unicorn-59591.exe
676	Unicorn-184.exe
232	Unicorn-51829.exe
3312	Unicorn-59406.exe
1804	Unicorn-53262.exe
3936	Unicorn-42088.exe
1600	Unicorn-4304.exe
4124	Unicorn-51476.exe
4900	Unicorn-25637.exe
2792	Unicorn-45067.exe
2308	Unicorn-48051.exe
4252	Unicorn-47880.exe
3316	Unicorn-41907.exe
3404	Unicorn-19060.exe
3420	Unicorn-8967.exe
3204	Unicorn-6328.exe
4668	Unicorn-275.exe
4604	Unicorn-26822.exe
844	Unicorn-446.exe
3664	Unicorn-2994.exe
444	Unicorn-7316.exe
5044	Unicorn-46118.exe
2996	Unicorn-29357.exe
4824	Unicorn-41907.exe
1964	Unicorn-181.exe
4364	Unicorn-9491.exe
1420	Unicorn-12916.exe
4300	Unicorn-16398.exe
3668	Unicorn-55925.exe
4408	Unicorn-57358.exe
1376	Unicorn-64379.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 4392	2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe	87
PID 2356 wrote to memory of 4392	2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe	87
PID 2356 wrote to memory of 4392	2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe	87
PID 4392 wrote to memory of 2020	4392	Unicorn-9262.exe	90
PID 4392 wrote to memory of 2020	4392	Unicorn-9262.exe	90
PID 4392 wrote to memory of 2020	4392	Unicorn-9262.exe	90
PID 2356 wrote to memory of 1264	2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe	91
PID 2356 wrote to memory of 1264	2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe	91
PID 2356 wrote to memory of 1264	2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe	91
PID 1264 wrote to memory of 2328	1264	Unicorn-64629.exe	94
PID 1264 wrote to memory of 2328	1264	Unicorn-64629.exe	94
PID 1264 wrote to memory of 2328	1264	Unicorn-64629.exe	94
PID 2020 wrote to memory of 3644	2020	Unicorn-18434.exe	95
PID 2020 wrote to memory of 3644	2020	Unicorn-18434.exe	95
PID 2020 wrote to memory of 3644	2020	Unicorn-18434.exe	95
PID 2356 wrote to memory of 5012	2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe	96
PID 2356 wrote to memory of 5012	2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe	96
PID 2356 wrote to memory of 5012	2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe	96
PID 4392 wrote to memory of 1244	4392	Unicorn-9262.exe	97
PID 4392 wrote to memory of 1244	4392	Unicorn-9262.exe	97
PID 4392 wrote to memory of 1244	4392	Unicorn-9262.exe	97
PID 2328 wrote to memory of 4340	2328	Unicorn-5124.exe	98
PID 2328 wrote to memory of 4340	2328	Unicorn-5124.exe	98
PID 2328 wrote to memory of 4340	2328	Unicorn-5124.exe	98
PID 1264 wrote to memory of 3096	1264	Unicorn-64629.exe	99
PID 1264 wrote to memory of 3096	1264	Unicorn-64629.exe	99
PID 1264 wrote to memory of 3096	1264	Unicorn-64629.exe	99
PID 5012 wrote to memory of 3424	5012	Unicorn-65055.exe	100
PID 5012 wrote to memory of 3424	5012	Unicorn-65055.exe	100
PID 1244 wrote to memory of 3776	1244	Unicorn-14096.exe	101
PID 5012 wrote to memory of 3424	5012	Unicorn-65055.exe	100
PID 1244 wrote to memory of 3776	1244	Unicorn-14096.exe	101
PID 1244 wrote to memory of 3776	1244	Unicorn-14096.exe	101
PID 2020 wrote to memory of 1512	2020	Unicorn-18434.exe	102
PID 2020 wrote to memory of 1512	2020	Unicorn-18434.exe	102
PID 2020 wrote to memory of 1512	2020	Unicorn-18434.exe	102
PID 2356 wrote to memory of 2724	2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe	104
PID 2356 wrote to memory of 2724	2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe	104
PID 2356 wrote to memory of 2724	2356	230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe	104
PID 4392 wrote to memory of 4264	4392	Unicorn-9262.exe	103
PID 4392 wrote to memory of 4264	4392	Unicorn-9262.exe	103
PID 4392 wrote to memory of 4264	4392	Unicorn-9262.exe	103
PID 3644 wrote to memory of 1688	3644	Unicorn-5648.exe	105
PID 3644 wrote to memory of 1688	3644	Unicorn-5648.exe	105
PID 3644 wrote to memory of 1688	3644	Unicorn-5648.exe	105
PID 4340 wrote to memory of 3632	4340	Unicorn-49410.exe	106
PID 4340 wrote to memory of 3632	4340	Unicorn-49410.exe	106
PID 4340 wrote to memory of 3632	4340	Unicorn-49410.exe	106
PID 2328 wrote to memory of 3896	2328	Unicorn-5124.exe	107
PID 2328 wrote to memory of 3896	2328	Unicorn-5124.exe	107
PID 2328 wrote to memory of 3896	2328	Unicorn-5124.exe	107
PID 4264 wrote to memory of 3032	4264	Unicorn-31515.exe	108
PID 4264 wrote to memory of 3032	4264	Unicorn-31515.exe	108
PID 4264 wrote to memory of 3032	4264	Unicorn-31515.exe	108
PID 4392 wrote to memory of 3260	4392	Unicorn-9262.exe	109
PID 4392 wrote to memory of 3260	4392	Unicorn-9262.exe	109
PID 4392 wrote to memory of 3260	4392	Unicorn-9262.exe	109
PID 5012 wrote to memory of 4636	5012	Unicorn-65055.exe	110
PID 5012 wrote to memory of 4636	5012	Unicorn-65055.exe	110
PID 5012 wrote to memory of 4636	5012	Unicorn-65055.exe	110
PID 3424 wrote to memory of 864	3424	Unicorn-43266.exe	111
PID 3424 wrote to memory of 864	3424	Unicorn-43266.exe	111
PID 3424 wrote to memory of 864	3424	Unicorn-43266.exe	111
PID 1688 wrote to memory of 5088	1688	Unicorn-43266.exe	112

C:\Users\Admin\AppData\Local\Temp\230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe
"C:\Users\Admin\AppData\Local\Temp\230805a636a3aac35d216dbf015ae0816ea91dd02e3e462cf5fc8d7300cf1ccbN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9262.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9262.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5648.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        8⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        9⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        10⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25180.exe
        10⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        10⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        10⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
        9⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        9⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        9⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        9⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2682.exe
        8⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44750.exe
        9⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe
        9⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
        9⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        9⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43006.exe
        8⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        8⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60953.exe
        8⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61810.exe
        7⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        8⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58291.exe
        8⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        8⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64299.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        7⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64085.exe
        7⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41964.exe
        7⤵
        
        PID:16080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12916.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26237.exe
        8⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        8⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43458.exe
        8⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        8⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57708.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
        7⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1778.exe
        7⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
        7⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60947.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35863.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe
        7⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46777.exe
        7⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        7⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1979.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27507.exe
        6⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
        6⤵
        
        PID:14736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35356.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35621.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44220.exe
        8⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        8⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63700.exe
        8⤵
        
        PID:17268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36086.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        7⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe
        7⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10523.exe
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
        7⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        7⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36198.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        7⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52719.exe
        6⤵
        
        PID:12524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
        6⤵
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
        6⤵
        
        PID:18116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26822.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
        6⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
        8⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41482.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        7⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        7⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        7⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe
        6⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        6⤵
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
        6⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14316.exe
        6⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        6⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64047.exe
        5⤵
        
        PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12659.exe
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18969.exe
        5⤵
        
        PID:14884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29130.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23400.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
        7⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        8⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33221.exe
        9⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14681.exe
        9⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        9⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        9⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27746.exe
        8⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
        8⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        8⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        8⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54559.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12264.exe
        7⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
        7⤵
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        6⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28942.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20939.exe
        8⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        8⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        8⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        8⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
        7⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        7⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        7⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20447.exe
        7⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        7⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38128.exe
        6⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48666.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        6⤵
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59266.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe
        6⤵
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19060.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40215.exe
        6⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29613.exe
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59256.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60383.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        7⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        7⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe
        7⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        7⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
        7⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12512.exe
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        6⤵
        
        PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
        5⤵
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8055.exe
        6⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        6⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
        6⤵
        
        PID:14388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exe
        6⤵
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55316.exe
        5⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        5⤵
        
        PID:17276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48051.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
        6⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54960.exe
        8⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
        7⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61950.exe
        7⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe
        7⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43125.exe
        6⤵
        
        PID:15976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        6⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32200.exe
        6⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        5⤵
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28942.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33276.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        7⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64719.exe
        7⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        7⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63219.exe
        6⤵
        
        PID:14580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        6⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60953.exe
        6⤵
        
        PID:17336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16180.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        6⤵
        
        PID:15416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
        6⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63981.exe
        5⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe
        5⤵
        
        PID:14200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        5⤵
        
        PID:16024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18352.exe
        5⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2768.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3673.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        7⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13670.exe
        7⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61197.exe
        6⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        6⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47931.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        6⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47739.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        6⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
        6⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31738.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
        5⤵
        
        PID:13764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
        5⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe
        5⤵
        
        PID:16356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43976.exe
      4⤵
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        6⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        6⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28243.exe
        5⤵
        
        PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
        5⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55393.exe
        5⤵
        
        PID:17032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10668.exe
      4⤵
      PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35537.exe
        5⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        5⤵
        
        PID:12232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        5⤵
        
        PID:9340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15918.exe
      4⤵
      PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
      4⤵
      PID:13428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
      4⤵
      PID:17180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14096.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62481.exe
        7⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47624.exe
        8⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10844.exe
        9⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62010.exe
        9⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        9⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe
        8⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62946.exe
        8⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38964.exe
        8⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49030.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46883.exe
        7⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        8⤵
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        7⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37064.exe
        7⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50131.exe
        7⤵
        
        PID:16584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe
        6⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49922.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        8⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5588.exe
        8⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        8⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        7⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
        7⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        7⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
        6⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19390.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        6⤵
        
        PID:14956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36309.exe
        6⤵
        
        PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        5⤵
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-239.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21803.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        7⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        7⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        7⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
        6⤵
        
        PID:13256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        6⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54227.exe
        6⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53226.exe
        6⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        6⤵
        
        PID:16016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8147.exe
        6⤵
        
        PID:16348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        6⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22553.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35621.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37372.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6227.exe
        7⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        7⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54465.exe
        7⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        6⤵
        
        PID:14956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59453.exe
        6⤵
        
        PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26231.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38326.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31198.exe
        6⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        6⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47620.exe
        5⤵
        
        PID:8148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27370.exe
        5⤵
        
        PID:11820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe
        5⤵
        
        PID:15372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64526.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25017.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60939.exe
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21458.exe
        6⤵
        
        PID:14472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        6⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
        5⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
        5⤵
        
        PID:14996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        5⤵
        
        PID:15964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        5⤵
        
        PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
      4⤵
      PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        5⤵
        
        PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50813.exe
      4⤵
      PID:8948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20480.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
      4⤵
      PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7178.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        6⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62646.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13584.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55027.exe
        9⤵
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60077.exe
        9⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46648.exe
        8⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        8⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        8⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40823.exe
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        7⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        7⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        7⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        8⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        8⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        8⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
        7⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        7⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62218.exe
        6⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27894.exe
        6⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19679.exe
        6⤵
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
        6⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exe
        5⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        6⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        7⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20939.exe
        8⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        8⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27819.exe
        8⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18527.exe
        7⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19461.exe
        7⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        6⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13072.exe
        6⤵
        
        PID:16372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29943.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44555.exe
        6⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25140.exe
        6⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21239.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        6⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14572.exe
        5⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34392.exe
        5⤵
        
        PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53762.exe
        5⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        6⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6903.exe
        7⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe
        7⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38690.exe
        6⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15610.exe
        6⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52421.exe
        6⤵
        
        PID:14860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        6⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        6⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        6⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32752.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50997.exe
        7⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        7⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64337.exe
        6⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        6⤵
        
        PID:460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        6⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31738.exe
        5⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30445.exe
        5⤵
        
        PID:13236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33595.exe
        5⤵
        
        PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3008.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        6⤵
        
        PID:12052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        6⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56413.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        5⤵
        
        PID:11088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25807.exe
        5⤵
        
        PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33273.exe
      4⤵
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4197.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        5⤵
        
        PID:15984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        5⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        5⤵
        
        PID:9304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-741.exe
      4⤵
      PID:8844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10321.exe
      4⤵
      PID:12920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
      4⤵
      PID:17148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53262.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        5⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52930.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
        7⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29662.exe
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        6⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        6⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        6⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
        5⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53226.exe
        6⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        6⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:64
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        6⤵
        
        PID:17500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25353.exe
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28616.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3318.exe
        5⤵
        
        PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25204.exe
      4⤵
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6334.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        6⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        6⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52214.exe
        5⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        5⤵
        
        PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        5⤵
        
        PID:9920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37366.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe
        5⤵
        
        PID:12284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        5⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        5⤵
        
        PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
      4⤵
      PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
      4⤵
      PID:12772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
      4⤵
      PID:17228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
      4⤵
      PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
        5⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57258.exe
        6⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58412.exe
        6⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26402.exe
        7⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
        7⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45364.exe
        6⤵
        
        PID:16172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        6⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
        5⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe
        5⤵
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        5⤵
        
        PID:10916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        5⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        5⤵
        
        PID:10676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62889.exe
        5⤵
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
      4⤵
      PID:8268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe
      4⤵
      PID:12436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
      4⤵
      PID:1220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45372.exe
    3⤵
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
      4⤵
      PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        5⤵
        
        PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        5⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        5⤵
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        5⤵
        
        PID:10764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
      4⤵
      PID:9876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20971.exe
      4⤵
      PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
      4⤵
      PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
      4⤵
      PID:7456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59704.exe
    3⤵
    PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10960.exe
      4⤵
      PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21803.exe
      4⤵
      PID:11752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
      4⤵
      PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7938.exe
    3⤵
    PID:9444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
    3⤵
    PID:13224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
    3⤵
    PID:15880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
    3⤵
    PID:17048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
    3⤵
    PID:13096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5124.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49410.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52235.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16398.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
        8⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61219.exe
        9⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
        9⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27324.exe
        9⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
        9⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        9⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        8⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
        8⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28903.exe
        8⤵
        
        PID:14236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34749.exe
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20087.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
        8⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
        9⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        9⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20447.exe
        9⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        9⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        8⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
        8⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        8⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19814.exe
        8⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56014.exe
        7⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61713.exe
        7⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
        7⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55925.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20671.exe
        8⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        9⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        9⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        9⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        9⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44381.exe
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22509.exe
        8⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46030.exe
        8⤵
        
        PID:17000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63852.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59865.exe
        7⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
        7⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7460.exe
        6⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58412.exe
        7⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        7⤵
        
        PID:524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61510.exe
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58291.exe
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        6⤵
        
        PID:14488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16077.exe
        6⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51829.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18708.exe
        6⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42757.exe
        8⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19882.exe
        9⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40503.exe
        8⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23037.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58796.exe
        8⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        8⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38690.exe
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14086.exe
        7⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45408.exe
        7⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        7⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28480.exe
        7⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28616.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
        6⤵
        
        PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        5⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        6⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
        8⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe
        8⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe
        8⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        8⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43606.exe
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        7⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51008.exe
        7⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22391.exe
        6⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6855.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63152.exe
        6⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
        6⤵
        
        PID:14932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        6⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33741.exe
        5⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41248.exe
        5⤵
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50776.exe
        5⤵
        
        PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18879.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42428.exe
        7⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38326.exe
        8⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe
        9⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exe
        9⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
        8⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23999.exe
        8⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33884.exe
        7⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe
        7⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28345.exe
        7⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe
        7⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe
        8⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        8⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        8⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        8⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        7⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6903.exe
        7⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        7⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        6⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
        7⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        7⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        6⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40718.exe
        6⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exe
        6⤵
        
        PID:17304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64379.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46124.exe
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17766.exe
        7⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        7⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22806.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21717.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52421.exe
        6⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13499.exe
        6⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        6⤵
        
        PID:17464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11575.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
        6⤵
        
        PID:11764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28345.exe
        6⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53250.exe
        6⤵
        
        PID:15784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        6⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        6⤵
        
        PID:9908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58291.exe
        5⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11286.exe
        5⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27220.exe
        5⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42406.exe
        5⤵
        
        PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59591.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57358.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16139.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        8⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
        7⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        7⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        7⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        6⤵
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13072.exe
        6⤵
        
        PID:16344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57709.exe
        6⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16418.exe
        5⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58412.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        6⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        6⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
        5⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        5⤵
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe
        5⤵
        
        PID:15000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15000 -s 464
        6⤵
        Program crash
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36309.exe
        5⤵
        
        PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18442.exe
      4⤵
      PID:692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58412.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        6⤵
        
        PID:728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        5⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30972.exe
        6⤵
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
        6⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2473.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        5⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        5⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40503.exe
        5⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26402.exe
        6⤵
        
        PID:17196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
        5⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        5⤵
        
        PID:8352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44963.exe
      4⤵
      PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
      4⤵
      PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
      4⤵
      PID:14868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe
      4⤵
      PID:17292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23924.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60842.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2994.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
        6⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26737.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61907.exe
        7⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
        7⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31460.exe
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        7⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7528.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30960.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        7⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8688.exe
        7⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
        7⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe
        6⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52214.exe
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49980.exe
        6⤵
        
        PID:14688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50808.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64323.exe
        7⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9740.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12886.exe
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64732.exe
        6⤵
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        6⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47563.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        6⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        6⤵
        
        PID:9904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        5⤵
        
        PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3847.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32361.exe
        5⤵
        
        PID:16008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51565.exe
        5⤵
        
        PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9491.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50864.exe
        6⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46067.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        7⤵
        
        PID:16036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exe
        7⤵
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        6⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        6⤵
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18210.exe
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31994.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
        5⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39941.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42922.exe
        5⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        5⤵
        
        PID:14660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        5⤵
        
        PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42407.exe
      4⤵
      PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
        5⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9740.exe
        5⤵
        
        PID:17212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe
      4⤵
      PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
      4⤵
      PID:14232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22510.exe
      4⤵
      PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33464.exe
      4⤵
      PID:17456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23912.exe
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10741.exe
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9015.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19450.exe
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        5⤵
        
        PID:16084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59262.exe
      4⤵
      PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        5⤵
        
        PID:10428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
        5⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        5⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        5⤵
        
        PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19992.exe
      4⤵
      PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15605.exe
      4⤵
      PID:10840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
      4⤵
      PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
      4⤵
      PID:15184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
      4⤵
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        5⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-247.exe
        5⤵
        
        PID:10776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53229.exe
        5⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51535.exe
        5⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27508.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18416.exe
        5⤵
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27182.exe
        5⤵
        
        PID:14088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe
        5⤵
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        5⤵
        
        PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
      4⤵
      PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe
      4⤵
      PID:13388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
      4⤵
      PID:17344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
    3⤵
    PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
      4⤵
      PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
        5⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26469.exe
        5⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53835.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
      4⤵
      PID:11104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43237.exe
      4⤵
      PID:14948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21931.exe
      4⤵
      PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
      4⤵
      PID:6744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
    3⤵
    PID:8272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39928.exe
    3⤵
    PID:12164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
    3⤵
    PID:16120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
    3⤵
    PID:2712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51476.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16304.exe
        6⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39682.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        8⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        8⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62030.exe
        8⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        8⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe
        7⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53475.exe
        7⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51790.exe
        7⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        7⤵
        
        PID:17472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36121.exe
        6⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63529.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        7⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        7⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33464.exe
        6⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22800.exe
        5⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe
        6⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15099.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        7⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        7⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55393.exe
        7⤵
        
        PID:17040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11618.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
        6⤵
        
        PID:736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        6⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41915.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
        6⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        6⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49051.exe
        6⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        6⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10476.exe
        5⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        5⤵
        
        PID:17128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46359.exe
        5⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39182.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24490.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31284.exe
        7⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12547.exe
        7⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
        7⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38122.exe
        6⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        6⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56431.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47563.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58110.exe
        6⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2789.exe
        6⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        6⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        6⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        5⤵
        
        PID:8600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12231.exe
        5⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53821.exe
        6⤵
        
        PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
        5⤵
        
        PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
      4⤵
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8055.exe
        5⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        5⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
        5⤵
        
        PID:14300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        5⤵
        
        PID:10012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18436.exe
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11003.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
        5⤵
        
        PID:12044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        5⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        5⤵
        
        PID:14256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1052.exe
      4⤵
      PID:8412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64856.exe
      4⤵
      PID:12564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
      4⤵
      PID:17112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32329.exe
      4⤵
      PID:13092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        6⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        6⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28616.exe
        5⤵
        
        PID:11580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17647.exe
        5⤵
        
        PID:12968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53375.exe
        5⤵
        
        PID:16440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
      4⤵
      PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        5⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47709.exe
        5⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        5⤵
        
        PID:16364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        5⤵
        
        PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
      4⤵
      PID:9380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
      4⤵
      PID:13140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14996.exe
      4⤵
      PID:8556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35777.exe
    3⤵
    - Executes dropped EXE
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
    3⤵
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
      4⤵
      PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14532.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe
        5⤵
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        5⤵
        
        PID:16084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        5⤵
        
        PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28456.exe
      4⤵
      PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58110.exe
      4⤵
      PID:12788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2789.exe
      4⤵
      PID:16148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13670.exe
      4⤵
      PID:15056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
      4⤵
      PID:11308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
    3⤵
    PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58108.exe
      4⤵
      PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5066.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6712.exe
        5⤵
        
        PID:14652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3673.exe
      4⤵
      PID:10860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
      4⤵
      PID:15960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
      4⤵
      PID:16448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
      4⤵
      PID:10956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31621.exe
    3⤵
    PID:8828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
    3⤵
    PID:12840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3181.exe
    3⤵
    PID:1696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60842.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
      4⤵
      PID:244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55045.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        6⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        5⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe
        6⤵
        
        PID:17424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38122.exe
        5⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        5⤵
        
        PID:15884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        5⤵
        
        PID:9580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41915.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        5⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        5⤵
        
        PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
      4⤵
      PID:9120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64351.exe
      4⤵
      PID:15852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46118.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
      4⤵
      PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16321.exe
      4⤵
      PID:10392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14062.exe
      4⤵
      PID:13532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
      4⤵
      PID:15736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1316.exe
    3⤵
    PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50864.exe
      4⤵
      PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26682.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54335.exe
        5⤵
        
        PID:15924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        5⤵
        
        PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
      4⤵
      PID:9840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44539.exe
      4⤵
      PID:13604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24713.exe
      4⤵
      PID:16424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
    3⤵
    PID:6376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe
    3⤵
    PID:11256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
    3⤵
    PID:14848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
    3⤵
    PID:17356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29357.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6913.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63990.exe
        6⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        6⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe
        5⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46349.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        5⤵
        
        PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43536.exe
      4⤵
      PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        5⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23475.exe
        5⤵
        
        PID:10596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28919.exe
      4⤵
      PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
      4⤵
      PID:14160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
    3⤵
    PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43510.exe
        5⤵
        
        PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe
        5⤵
        
        PID:12064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        5⤵
        
        PID:9364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55654.exe
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6366.exe
      4⤵
      PID:12728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
      4⤵
      PID:14284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
      4⤵
      PID:17008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62751.exe
    3⤵
    PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
      4⤵
      PID:9740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61628.exe
    3⤵
    PID:10616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28398.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19663.exe
    3⤵
    PID:16368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7316.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7316.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe
    3⤵
    PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29363.exe
      4⤵
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exe
        5⤵
        
        PID:12688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6980 -s 752
        5⤵
        Program crash
        
        PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
      4⤵
      PID:10016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
      4⤵
      PID:14048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
      4⤵
      PID:16036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64373.exe
    3⤵
    PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
      4⤵
      PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
      4⤵
      PID:11632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46297.exe
      4⤵
      PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46861.exe
    3⤵
    PID:9644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
    3⤵
    PID:12756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
  2⤵
  PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11575.exe
    3⤵
    PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62513.exe
      4⤵
      PID:15196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46097.exe
    3⤵
    PID:12196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50661.exe
    3⤵
    PID:5360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61729.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61729.exe
  2⤵
  PID:6876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46141.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46141.exe
  2⤵
  PID:10948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46233.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46233.exe
  2⤵
  PID:13460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2973.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2973.exe
  2⤵
  PID:15000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6980 -ip 6980
1⤵
PID:15584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 15000 -ip 15000
1⤵
PID:14312

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 316 -ip 316
1⤵
PID:16004

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15820

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7864

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:15260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4436 -ip 4436
1⤵
PID:7392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 17240 -ip 17240
1⤵
PID:7836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe

Filesize
468KB

MD5
5306fde86ee4a88f41b4429a48f728c7

SHA1
91bed17501a7cb58a00d0e4668f0018505a131a0

SHA256
665f1d2b9b291af3168f7efbffaeccc98c230f35a9c782c8f1875c1ebce7411b

SHA512
471a6c3eb414e939cf16d1a0c3cc95acffe8a8e9e5a34fb73c1a93849f2a4217401ef85ad7bce0d8e57cf14e67cfd4b6361b103055b47942f3efd493a254fb06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe

Filesize
468KB

MD5
2ae0c1d539230a3966de18a6db19144c

SHA1
be1c098a7def7561caef7b1287ecb6722c8a5b20

SHA256
fa34a6378271cc11fa0615f65b127d0ffaa271ec50678054a002d781314d63c1

SHA512
6dfa1a693873f32e90443792840e760022edd4e9cfec80f5771271f51a2216df4000687ca1a3fc5a5f90fab55cf7445652d65169ddfc6264f1ae0aabf447b3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe

Filesize
468KB

MD5
b4a4610d4c14308e0b62ef6d96b1ac79

SHA1
e7ddcb4706df5ae2d257edd26a75338dff17b36b

SHA256
3ed482b299fbfe7010a4c54ce4c0f250103ebaec5742f7ad1e67666e7bd84678

SHA512
2cbd9be69cb76eb222aae97b13b4ecb83fc657d49e4cf2ffc2e39d0d4caac07626db3524f3f5a1b7636851053963787d90db49395b4aabd9c7066b7dd33d3b0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14096.exe

Filesize
468KB

MD5
a9593dc6427ad1730796e1bac4d07895

SHA1
12e8c14d07b61151e4f3132445bcf6a254ba0d7b

SHA256
6f6c817ab6e1ea89f5d1537c97332d48915761a17a44c363f75f3e68d1ac5a7a

SHA512
4677a8b156563d04e56d4cd67c43f9f23622d9f0843d4cd51d4e4a9ed9b6dfaa35f854993580025c023ff55bc3e0207646a90838fcf22ebe47ea1972438d52cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe

Filesize
468KB

MD5
89a8be34db007d986c74a95c22a34571

SHA1
b2c9f6ed8c546fad312a56c1fd3aa587eac37928

SHA256
3df7dab8abca9347cbf698f946825bd4f24fac81500789c9480c8c67cb9bdcc4

SHA512
ef9caacd022a4b17c2747aa9ba872e8947faa6017dd99b632db712eaed6ec2d52c721361a68251b427bb463b4d43245b6f8a3e7a6d37e35e66d2b0c61e1f183c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe

Filesize
468KB

MD5
bccc4e1cac4e59cb1c7db250aaacaf93

SHA1
11523fa17a7c863e263d6c045b6cb36d3d17014c

SHA256
8288897f4db2856f0a61526d26509ca0737976b35d15d652ff3d0a93e49b62ee

SHA512
3bdbd01009a18921e8e07904f9220c873ef12d50320f7185db9961dedca1347af6a88ad918159e7b08e27579c467b4301d1a775e42d1737348a06d01952fa8ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe

Filesize
468KB

MD5
efd3f5add04088293a7b88ef33548456

SHA1
653da02bc83eda1d2a6fe36dcf17db7f75daf82a

SHA256
5a5fa2e8de35fe281ca2dd6e0a9102a79198df3481feb1b351204664fa2efaee

SHA512
93f04c935f58780b85d5efc5bdd385e6d308a5d7d9b9b612643bf346c767b9de06bf96d0b47d266d16d1ba5a4dcc3d3cc05c9e06ae215e88e1b284a5d8e15292

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe

Filesize
468KB

MD5
2335bfb2962ae9783914ece283c5950f

SHA1
bf7a093dce8f958ff2f72552e08f719233bd826e

SHA256
4ce4fc75c98fa2bc98e489a3d4eceb7ef130b774e4629713ff28921149e0be8c

SHA512
1ff2925254e7afd637bfea6ae75628267c43e3ccb5d921123a85593b5c11c2c116d94cc50496847e517c19bca0989df5817fd91f2e373dbdb010f300b7b249ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23400.exe

Filesize
468KB

MD5
ac99a5759fc0de376850eafdd4ddd1c1

SHA1
5f82ce202e2eeb44b8c9088b6d35b65b7e652578

SHA256
469cee09c96ccd960cb28f5d3f55ae6a5f7110a31d0ffe639939583415016dba

SHA512
6fbf0fa031f084f51ea571199b0c0fef2827ad6a92cd57d651d9962a811be400d6699f9d19f6304401dcb6407c664effad96c55a962843f390999f7d2ad34ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23924.exe

Filesize
468KB

MD5
76d4104ef906c925cd1ba5d1e558f68f

SHA1
3e81b366de311e4e6cc6288f36434a8ad96afe12

SHA256
1472e19c80d32ed5b839fa822c8718890f92e87cfce21983fec9754e17aa5193

SHA512
db6a7648bbad35019a5a1ec935901dd81c3c320cf660c390ac496906042d61ced690ba9e69acf3658e3882fc72c48ae5ab66fe525bf6f28c52af40c79a09fdb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe

Filesize
468KB

MD5
ea62f7d086b46e7edd8661509e8249ab

SHA1
de524f0b79000d29a80b47ec73875c8838da4db4

SHA256
0ad3e3c31eb0f233246c0712a021821dc45ba9b4099ddb3254783a68c62ae694

SHA512
f847fab4079df2d468496b3ef4fe8a85e721c40c58785a4e456492cde555704fcd1b9d1196910eeaaadec243739907fcd358e676c9b814b1f4ca4b7a9e0f1757

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe

Filesize
468KB

MD5
ead36a2e63f7f14fd3ff042b02346041

SHA1
d6756be99120c3ae2039d0a7d432f7a6fb2651d3

SHA256
1d835cb221852802b81841a9b31c90da7c1238cc6da1b05ef968b42b670e3daf

SHA512
c7d017d8db78b63d97e805a8833f9216bc344f27c8b59e23d7a7eed74677426c482243fedde0857e534e6163f0b530f50b7bbafcc533a88e26558bea2bc60d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe

Filesize
468KB

MD5
3d03a8ef60a5186df20a44c621465676

SHA1
97c8f577eec16b3e7c091987f87b3f9d40ca99ce

SHA256
1d2e88307f1e9444f3e42acf3d46bd0d405fb035112b5dbbc29380d99289437f

SHA512
b7d207e3d5e5c6e9264f8b63f665fec0c546a61137a8ba5b898de1223e6587a1908364abcee84db93de9f2a81dcffb3aadbd39f0ea0306124715b93a113dec20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31515.exe

Filesize
468KB

MD5
4601469eab80da7e2c573678fced5de6

SHA1
0179f87f5c28786feb8f7e8eef3aa678d31e75ea

SHA256
916b3a526b9561195300e4b83ec46ece3655dd1d9becd19506561bc089c34e66

SHA512
ae38bebb2d080ca8e113bb7ed39b91c6873986f57bc5bf5e9726d9a07428b5bb029202fb19773d0006d3bb116ec00d66dcf31630390df359fac7c3abfd77be0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe

Filesize
468KB

MD5
6ef14e38ee024d715e4922a5c9ebe35d

SHA1
b35c07503812ea25dc56b366cf8eee800b3afb2c

SHA256
12e0249b7467bf4a63ace4d15c0a384585f6c314496b57d9a0892a6ce919bbde

SHA512
3a4c3f5dfa0107e394d36ed3fcd31bae559c911a1e09fe77a4c11cf286170bae24d29272b6a1fdf76a580c97841572db3b5c649652315d662e8e100b95949238

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35356.exe

Filesize
468KB

MD5
564027de3e958ef6f5dd07126c493448

SHA1
873a560fb459fe235adfc0431cee7cfd27565c4b

SHA256
e485454d087b8010e3887b3cad163462625949323593aedccde3ab1ea5e33633

SHA512
ba8220630c652f63f48bf57be4aef99ffb7b778240e0478c8be3961fd9365dc4ca35e69bc941088cbfb7b7f01c90af557556d7b5f311976dfc640db5f5465118

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe

Filesize
468KB

MD5
0e4d7087e60619ce83bfb64ace1dbcd2

SHA1
fdd3b2b0dc71ffc890b47dfd3a0ef3c144aa98f8

SHA256
6942c8cdb132d198ab976a9ada2f91c7894e8f58ebe986463422f5a360b77b2a

SHA512
34deadc5fe2b68c013f474aac7c9315d2419813e846e97b55de1710c656b9160c169a6fb92182f20af74c0b10da89b8729114db88894e9152434ffc50e150300

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe

Filesize
468KB

MD5
6041a1f43ffc0d28fb1b5b5c07d41fd2

SHA1
50c962f223754515427fd1e115a38c74f91fe603

SHA256
327a6d6707b719ca243acdbb5175fe8307622bcf6198c734435921e775c23d75

SHA512
ae9fec680de1ea1bbbf3216c50661ade11a6360ded9a11a878cbbea228c221c3e472d06dc731edcb384c9fb8db7017d2daa6f093fc770ea2b6da798e6d64d975

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe

Filesize
468KB

MD5
777181741c11b98d41da91897520b003

SHA1
00cb01d1b776683e9277b27ec2f1fcac22016e47

SHA256
66f0d1c23340507e04fdbb8838848072b0f860d2d8d3a5f5b25f8c2e6e601b5b

SHA512
d79b54fd1adcc8799a7054671acb19ef2fa842ea539b60541b550eeca694e8039ce8ea365d2f54d9f12b3d7c14f9e59c12229cfb6077d61da06a75c83ed2359e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe

Filesize
468KB

MD5
5e1dfdf571ac939898de77265a3e48a6

SHA1
e676350316502ad29369677bc94cc4fb8fa4d966

SHA256
3e605194f795c9e925bae0cd18012f18b85507e0dc7c3ddd48801ba8ef614fb7

SHA512
692094dc2cfa7f6471764fd67482806f2ce99d4b8ca8c1ca83b2aa07cc4139fc350ae0f61c22df9d51378f4df9274d6a02c5a5935e648e5cd992159f3735d458

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49410.exe

Filesize
468KB

MD5
1fe5a2b0873b567cc599acd1171d15a5

SHA1
301d98fd271ec87c854350bf3ea66bab37b8d689

SHA256
9c817289eacdb3d2adaa9ade1c306f2c9ac72af93f25b4063df885b5499c863b

SHA512
f3bcc28d63859a339cbe22dbc75f85db282d83bd7079ba6f8632791c02d82ef0552337686fc526d06d6aac87ef3f5a6a2434c456c617341bb1184644c8aba926

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5124.exe

Filesize
468KB

MD5
91713608e20ddee16e44ec318786b1be

SHA1
d488a1b6e1e08c90693849af58bf1766dcc50409

SHA256
e6e5b42481e4140cb4ef1cd2382a46e89d9c8ed44bc65f04cebf991194e470a1

SHA512
f74d911eb22acb999c9816f5f09d4494960b17e2301049b798209df64361844b013422c210c28490a1bbab756316c73a37222ab968f1e75713d77adfaf3b6bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51829.exe

Filesize
468KB

MD5
d58d9ccdd88133fc60d1540076ea449e

SHA1
cc2387f89e42f0b29984ca3bd9fb49389bcfc333

SHA256
c435837770240505c2c96e3c34209423ea61188b80a686fc753ff7a84573da4f

SHA512
7a2751fe656b0623dcbce69f132fd3dd93ede2da4bad692c175f20d48a170de63720214852c99c9a607f491b0abc1b7641cc6fb4d537b1cbfda47c2b1f56d707

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52235.exe

Filesize
468KB

MD5
ccc371c4d4fd22c81cfdfb10cb212e64

SHA1
034337a2a4e8aa7687e48b9ba07c8e1b9b4ceb4e

SHA256
9adb11cf9c58f39bf0b8327aaac2ab7fb6e6ea0d5cf4cc07864503f8aec1c6ad

SHA512
2e3505b575ef96d3a76690067c04232248984f2e268e3eef4194e30675ee7b11d59dc8cff213f33d12e64d4f6ccb9acf266f657ae28ff25cecaa9ba948298a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5648.exe

Filesize
468KB

MD5
ba6d925ba12976cf14cfcd9b69aa64b7

SHA1
5512708cc112fbfb9f10155f89de58ec41b89793

SHA256
9f102239eaf0b25af491bae037c899f8eafcce4c30602e041ec3914b26aab4cc

SHA512
99ac1c47172956706120fa90aa62500f259b4ad0ec4551f942d27bf116323641e228a60e43272197d524b419f53ae2bb41c50cde45f6cce7b6f8082a71a861b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe

Filesize
468KB

MD5
f9753873efc03154c9b763bd94aba7d4

SHA1
60c1f3e5df33b8bc671ace371974497267919ba5

SHA256
4185868e4a2758e367638658192febafcf0528a67f708afcc52df53a92c0e84c

SHA512
2fa65c9d71de28286714842308b70de69c665f998832407bd64a3c6b2f8615917fe5613cf08042b9b4e794234ca5207a6d0b3c8175f3427ba1a8ab02d8b07e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60842.exe

Filesize
468KB

MD5
ff9fad196703e8712d08deaf51fdcbc5

SHA1
51d7336d3fc86fd5480ecda72d2989194d6cdf00

SHA256
8f7fcdbc411abfb213636906afe51dca08e441083f4620941bc0046fd9d77d8c

SHA512
bcf21af65b8824e73f276e072d2665a5250471e4303bbbe510f40c2b19f404a0cc03f7e2f557d2069c88d0e5c5ca5b71e1b4ef3d789e6452499aca5dbc416cfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe

Filesize
468KB

MD5
c0ba42d5275fec2403865b9e3fef89cd

SHA1
645d10c1341b06632aaa9dff8ffdcaa9ebec8de6

SHA256
0ba02f456bb8a22c3720b14ba9fa2fade2ca19367a57010293a5e0cdd82d240f

SHA512
0661fbfd6162ff1f38fab680f8eb5572ace8f279d6a7cb332455d0f7c917d0dbdb912fe5db04bc9eed83c83a873540095052dd7922e30edb0912f429ae007f0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe

Filesize
468KB

MD5
b38208f20f034028191d9564fa0fc112

SHA1
048ed8b097d2f55832da964be29a8cad23de5433

SHA256
03563ff1c625347c5e593adcb4f1103084fb91c1dd3a0e473f6eebdd592c56ef

SHA512
bcc987c4f4b5772fcc16b9f210c6cc3cd333a8853d5ed9c1c4127ac3264d2984deb868d4c4fe5e74aa90ed9aba0e917b377b1dc9d75d9eef63c1638c520ad7ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe

Filesize
468KB

MD5
92e19e3992427abcdc8a6864e8f37539

SHA1
665a46bd852284517442b5481848d86a48b51706

SHA256
f037d21de5f535c069f6153f89bc08e9ecf02c7d6f38ace8e579ea53297b2e5b

SHA512
4d446b7ad64f30068fdcc7583c20a7d7e7e229f7b4efe84b3763da8af0088ebfb19a70439cdbf43a3e1ec040cbc4f1ed320ca7470fb2a3c4f3bfe5ab54f972d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7178.exe

Filesize
468KB

MD5
693bd9df39fa283f5afa92bc61e26d81

SHA1
d9b65a7ae50c2707591ff51c100efb141cf9b0fc

SHA256
35ae023ef493c3a0ba85570ad3104ed353b399c88039c743452a0ae820a6d6c4

SHA512
a51e6432552de61709a1302ed1afdc741ad7f80f9a266420017dd05f4e26ccf4d44ba648a58c4af7316309529bde07d8bfd3a59d2bd70f4a118046edbf80df71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7209.exe

Filesize
192KB

MD5
ef2e0d18474b2151ef5876b1e89c2f1d

SHA1
aef9802fcf76c67d695bc77322bae5400d3bbe82

SHA256
3381de4ca9f3a477f25989dfc8b744e7916046b7aa369f61a9a2f7dc0963ec9e

SHA512
e81185705a3bd73645bf2b190bbf3aee060c1c72f98fa39665f254a755b0a5723ce8296422874eb50c7b5e8d6bcd90175b0ba28061221039172a3f50e8902cc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe

Filesize
468KB

MD5
6cf86312e1e16dd6d648962c888f4fec

SHA1
0c9058f684285fd491c886df5d09f1f091921ddc

SHA256
a82b3ecc6d3bb38b32ada8fb776c1e5ee22955a4a66b2d8ee1f8a14077c82bc7

SHA512
6f4e33a2d0cac68547333fafaa1b5b365b781f99b53a2fc8152f6f58532c8e49e00ca312445b86a1e17f2c776d2fe11e5e63ec5d2a033af499260a93c7705037

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9262.exe

Filesize
468KB

MD5
9f1a67b5c5bdca7d350c1fdc93228c6e

SHA1
78bf2fae613435f5e9df40a6faf0d0cd2c2b1d2c

SHA256
3b5b43a514874c075e70052df771e4a8a4ef22e384ae7ab3b6c8fee6c3199345

SHA512
5477855013d0a0a0afed94b7cee818bd4000c5c1d685744e96d9b8a8c0cf3ec229598a56378d7d32d2338b3abd4537351c0564d8a2c17e39f10c3af2537f7762

Download Submit
memory/232-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/244-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/444-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/676-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/692-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/820-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/824-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/844-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/864-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1076-3874-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1244-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1264-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1376-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1512-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1520-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1600-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1884-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-562-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3032-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3096-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3204-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3248-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3260-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3312-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3316-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3332-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3372-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3392-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3404-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3420-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3424-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3632-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3664-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3896-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3936-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3964-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4124-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4300-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4392-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4604-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4636-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4668-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4780-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4792-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4824-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5044-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5068-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5104-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15352-2789-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16148-2759-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16152-2741-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads