80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983f

Analysis

max time kernel
119s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe
Size

468KB
MD5

ea2d9fb5d65287eb5c06764e4bb470b0
SHA1

8d028a08402c9c2abc6b6cdba80cf1e454c0bdc0
SHA256

80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983f
SHA512

56104d74815b8c5e2f263b05cb29f318e95f8195b49068b9ba9dcfba933c683bf8fabbbb6ad09ed96cb520c0f4b980e8a05704ed8aae7d608da9cdcd9fa7ed37
SSDEEP

3072:K/NpogXdaP8Ukb/sPz5Wff1cfzjWI8JnmHe5op1QT43M1XNAila:K/noh0UkYP1WffhxPyQTmkXNA

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3068	Unicorn-19050.exe
1976	Unicorn-26746.exe
4700	Unicorn-23216.exe
2708	Unicorn-7233.exe
2784	Unicorn-33361.exe
3632	Unicorn-7041.exe
812	Unicorn-25415.exe
3524	Unicorn-42890.exe
1112	Unicorn-52682.exe
2192	Unicorn-26170.exe
2864	Unicorn-41738.exe
716	Unicorn-65265.exe
4136	Unicorn-5593.exe
2652	Unicorn-54545.exe
2084	Unicorn-64161.exe
3472	Unicorn-55355.exe
2848	Unicorn-30231.exe
1728	Unicorn-46154.exe
3124	Unicorn-65251.exe
2360	Unicorn-2729.exe
2960	Unicorn-26777.exe
772	Unicorn-27042.exe
3088	Unicorn-7176.exe
4536	Unicorn-7176.exe
3436	Unicorn-20911.exe
4916	Unicorn-18111.exe
3500	Unicorn-27042.exe
1184	Unicorn-6320.exe
232	Unicorn-55843.exe
4500	Unicorn-50289.exe
4620	Unicorn-28193.exe
1916	Unicorn-26570.exe
2124	Unicorn-61738.exe
3784	Unicorn-50363.exe
3504	Unicorn-22743.exe
4720	Unicorn-28609.exe
1124	Unicorn-37705.exe
1552	Unicorn-59491.exe
2928	Unicorn-9776.exe
2424	Unicorn-13113.exe
644	Unicorn-13113.exe
2792	Unicorn-33760.exe
3628	Unicorn-9063.exe
2176	Unicorn-14771.exe
3156	Unicorn-39275.exe
2152	Unicorn-59141.exe
2380	Unicorn-9675.exe
3912	Unicorn-58379.exe
5052	Unicorn-1772.exe
1448	Unicorn-1772.exe
4852	Unicorn-19845.exe
4224	Unicorn-6110.exe
748	Unicorn-34251.exe
3232	Unicorn-53587.exe
5116	Unicorn-28389.exe
2032	Unicorn-11860.exe
4028	Unicorn-60101.exe
4300	Unicorn-2732.exe
4276	Unicorn-60293.exe
4408	Unicorn-60485.exe
3732	Unicorn-4962.exe
1404	Unicorn-7563.exe
2660	Unicorn-18035.exe
2156	Unicorn-62140.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
6128	5232	WerFault.exe	182
15896	15628	WerFault.exe	757
15508	15336	WerFault.exe	726

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7428.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4956	dwm.exe
Token: SeChangeNotifyPrivilege	4956	dwm.exe
Token: 33	4956	dwm.exe
Token: SeIncBasePriorityPrivilege	4956	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe
3068	Unicorn-19050.exe
1976	Unicorn-26746.exe
4700	Unicorn-23216.exe
2708	Unicorn-7233.exe
2784	Unicorn-33361.exe
3632	Unicorn-7041.exe
812	Unicorn-25415.exe
3524	Unicorn-42890.exe
1112	Unicorn-52682.exe
2192	Unicorn-26170.exe
2652	Unicorn-54545.exe
2864	Unicorn-41738.exe
4136	Unicorn-5593.exe
716	Unicorn-65265.exe
2084	Unicorn-64161.exe
3472	Unicorn-55355.exe
2848	Unicorn-30231.exe
1728	Unicorn-46154.exe
772	Unicorn-27042.exe
3436	Unicorn-20911.exe
2960	Unicorn-26777.exe
3124	Unicorn-65251.exe
2360	Unicorn-2729.exe
4536	Unicorn-7176.exe
3500	Unicorn-27042.exe
4916	Unicorn-18111.exe
3088	Unicorn-7176.exe
1184	Unicorn-6320.exe
232	Unicorn-55843.exe
4500	Unicorn-50289.exe
1916	Unicorn-26570.exe
4620	Unicorn-28193.exe
3784	Unicorn-50363.exe
2124	Unicorn-61738.exe
3504	Unicorn-22743.exe
1124	Unicorn-37705.exe
4720	Unicorn-28609.exe
1552	Unicorn-59491.exe
2928	Unicorn-9776.exe
2424	Unicorn-13113.exe
644	Unicorn-13113.exe
2792	Unicorn-33760.exe
2152	Unicorn-59141.exe
748	Unicorn-34251.exe
2380	Unicorn-9675.exe
1448	Unicorn-1772.exe
2176	Unicorn-14771.exe
4224	Unicorn-6110.exe
5052	Unicorn-1772.exe
3628	Unicorn-9063.exe
3232	Unicorn-53587.exe
3912	Unicorn-58379.exe
4852	Unicorn-19845.exe
3156	Unicorn-39275.exe
5116	Unicorn-28389.exe
2032	Unicorn-11860.exe
4300	Unicorn-2732.exe
4028	Unicorn-60101.exe
4276	Unicorn-60293.exe
3732	Unicorn-4962.exe
4408	Unicorn-60485.exe
4988	Unicorn-64443.exe
1404	Unicorn-7563.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 3068	3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe	82
PID 3624 wrote to memory of 3068	3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe	82
PID 3624 wrote to memory of 3068	3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe	82
PID 3068 wrote to memory of 1976	3068	Unicorn-19050.exe	85
PID 3068 wrote to memory of 1976	3068	Unicorn-19050.exe	85
PID 3068 wrote to memory of 1976	3068	Unicorn-19050.exe	85
PID 3624 wrote to memory of 4700	3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe	86
PID 3624 wrote to memory of 4700	3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe	86
PID 3624 wrote to memory of 4700	3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe	86
PID 1976 wrote to memory of 2708	1976	Unicorn-26746.exe	89
PID 1976 wrote to memory of 2708	1976	Unicorn-26746.exe	89
PID 1976 wrote to memory of 2708	1976	Unicorn-26746.exe	89
PID 3068 wrote to memory of 2784	3068	Unicorn-19050.exe	90
PID 3068 wrote to memory of 2784	3068	Unicorn-19050.exe	90
PID 3068 wrote to memory of 2784	3068	Unicorn-19050.exe	90
PID 4700 wrote to memory of 3632	4700	Unicorn-23216.exe	91
PID 4700 wrote to memory of 3632	4700	Unicorn-23216.exe	91
PID 4700 wrote to memory of 3632	4700	Unicorn-23216.exe	91
PID 3624 wrote to memory of 812	3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe	92
PID 3624 wrote to memory of 812	3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe	92
PID 3624 wrote to memory of 812	3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe	92
PID 2708 wrote to memory of 3524	2708	Unicorn-7233.exe	96
PID 2708 wrote to memory of 3524	2708	Unicorn-7233.exe	96
PID 2708 wrote to memory of 3524	2708	Unicorn-7233.exe	96
PID 1976 wrote to memory of 1112	1976	Unicorn-26746.exe	97
PID 1976 wrote to memory of 1112	1976	Unicorn-26746.exe	97
PID 1976 wrote to memory of 1112	1976	Unicorn-26746.exe	97
PID 2784 wrote to memory of 2192	2784	Unicorn-33361.exe	98
PID 2784 wrote to memory of 2192	2784	Unicorn-33361.exe	98
PID 2784 wrote to memory of 2192	2784	Unicorn-33361.exe	98
PID 3632 wrote to memory of 2864	3632	Unicorn-7041.exe	99
PID 3632 wrote to memory of 2864	3632	Unicorn-7041.exe	99
PID 3632 wrote to memory of 2864	3632	Unicorn-7041.exe	99
PID 3068 wrote to memory of 716	3068	Unicorn-19050.exe	100
PID 3068 wrote to memory of 716	3068	Unicorn-19050.exe	100
PID 3068 wrote to memory of 716	3068	Unicorn-19050.exe	100
PID 3624 wrote to memory of 4136	3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe	101
PID 3624 wrote to memory of 4136	3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe	101
PID 3624 wrote to memory of 4136	3624	80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe	101
PID 4700 wrote to memory of 2652	4700	Unicorn-23216.exe	102
PID 4700 wrote to memory of 2652	4700	Unicorn-23216.exe	102
PID 4700 wrote to memory of 2652	4700	Unicorn-23216.exe	102
PID 812 wrote to memory of 2084	812	Unicorn-25415.exe	103
PID 812 wrote to memory of 2084	812	Unicorn-25415.exe	103
PID 812 wrote to memory of 2084	812	Unicorn-25415.exe	103
PID 3524 wrote to memory of 3472	3524	Unicorn-42890.exe	104
PID 3524 wrote to memory of 3472	3524	Unicorn-42890.exe	104
PID 3524 wrote to memory of 3472	3524	Unicorn-42890.exe	104
PID 1976 wrote to memory of 2848	1976	Unicorn-26746.exe	105
PID 1976 wrote to memory of 2848	1976	Unicorn-26746.exe	105
PID 1976 wrote to memory of 2848	1976	Unicorn-26746.exe	105
PID 2708 wrote to memory of 1728	2708	Unicorn-7233.exe	106
PID 2708 wrote to memory of 1728	2708	Unicorn-7233.exe	106
PID 2708 wrote to memory of 1728	2708	Unicorn-7233.exe	106
PID 2192 wrote to memory of 3124	2192	Unicorn-26170.exe	107
PID 2192 wrote to memory of 3124	2192	Unicorn-26170.exe	107
PID 2192 wrote to memory of 3124	2192	Unicorn-26170.exe	107
PID 716 wrote to memory of 2360	716	Unicorn-65265.exe	108
PID 716 wrote to memory of 2360	716	Unicorn-65265.exe	108
PID 716 wrote to memory of 2360	716	Unicorn-65265.exe	108
PID 3068 wrote to memory of 2960	3068	Unicorn-19050.exe	110
PID 3068 wrote to memory of 2960	3068	Unicorn-19050.exe	110
PID 3068 wrote to memory of 2960	3068	Unicorn-19050.exe	110
PID 4700 wrote to memory of 3436	4700	Unicorn-23216.exe	109

C:\Users\Admin\AppData\Local\Temp\80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe
"C:\Users\Admin\AppData\Local\Temp\80cdde4ed593dc9b5504d41bf6ca83abfc42caff2d17cc63dfc96ba18677983fN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26570.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60101.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        9⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63687.exe
        10⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        11⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        11⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        10⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58740.exe
        10⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        10⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
        9⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38095.exe
        10⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        9⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50667.exe
        9⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
        9⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1907.exe
        8⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        9⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        9⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        9⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57493.exe
        9⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62638.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        9⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        9⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23758.exe
        9⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24133.exe
        8⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28030.exe
        8⤵
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
        7⤵
        Executes dropped EXE
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        9⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42669.exe
        10⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe
        10⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        10⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        9⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
        9⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe
        8⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        8⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-918.exe
        8⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60707.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9100.exe
        8⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30138.exe
        8⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        8⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25546.exe
        7⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        7⤵
        
        PID:13464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13951.exe
        7⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28193.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        9⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        10⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        10⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51831.exe
        10⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe
        9⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe
        9⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1128.exe
        9⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10327.exe
        9⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        8⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        8⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32566.exe
        8⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28421.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        9⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
        8⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        8⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
        8⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe
        7⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
        7⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
        7⤵
        
        PID:15552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11575.exe
        8⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        9⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        9⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        9⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        8⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        8⤵
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
        7⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59415.exe
        7⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50630.exe
        7⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41477.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62157.exe
        8⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39165.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37683.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
        7⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49599.exe
        7⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57731.exe
        6⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
        7⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
        7⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31782.exe
        6⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52712.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51892.exe
        6⤵
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46154.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50363.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        9⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe
        10⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26446.exe
        10⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52654.exe
        9⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
        9⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        8⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6891.exe
        9⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
        9⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37963.exe
        8⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
        8⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9021.exe
        8⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42446.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59448.exe
        8⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        8⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28770.exe
        8⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23751.exe
        8⤵
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        7⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
        7⤵
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
        6⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        8⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
        8⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49854.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35646.exe
        7⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        8⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
        8⤵
        
        PID:15628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15628 -s 80
        9⤵
        Program crash
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30138.exe
        7⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        7⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39491.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38455.exe
        6⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
        6⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        8⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57375.exe
        8⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        8⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27854.exe
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        7⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        7⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51871.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        7⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
        7⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9643.exe
        7⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50931.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38020.exe
        5⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30797.exe
        6⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11684.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        8⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        7⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        7⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
        7⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        7⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        6⤵
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10173.exe
        6⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57375.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        6⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17804.exe
        6⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe
        5⤵
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61787.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64472.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6320.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11860.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5908.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52717.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6332.exe
        9⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60507.exe
        9⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
        8⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        8⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21910.exe
        7⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        7⤵
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        7⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe
        8⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
        8⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13947.exe
        7⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47883.exe
        7⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8868.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47651.exe
        6⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4723.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36146.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4962.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21752.exe
        6⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11575.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
        8⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe
        8⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41439.exe
        8⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        7⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        7⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        7⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        6⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37779.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
        6⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe
        6⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        6⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63116.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62767.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        6⤵
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54467.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57744.exe
        5⤵
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3972.exe
        5⤵
        
        PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61738.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        6⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46396.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        8⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        8⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        7⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        7⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49407.exe
        7⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43515.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
        7⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        7⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        7⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
        6⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59260.exe
        5⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24440.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9655.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        8⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
        8⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        8⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5011.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
        7⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        6⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39164.exe
        7⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        6⤵
        
        PID:15148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25441.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56291.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        6⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        5⤵
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
        5⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9597.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36640.exe
        5⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45141.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49768.exe
        8⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        8⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42875.exe
        7⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
        7⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8375.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58118.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        6⤵
        
        PID:12536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35698.exe
        6⤵
        
        PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28770.exe
        6⤵
        
        PID:15336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15336 -s 476
        7⤵
        Program crash
        
        PID:15508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        5⤵
        
        PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3758.exe
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
        5⤵
        
        PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29354.exe
      4⤵
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65095.exe
        7⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        6⤵
        
        PID:12840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        6⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17003.exe
        5⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59415.exe
        5⤵
        
        PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60775.exe
      4⤵
      PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        5⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe
        5⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
        5⤵
        
        PID:14816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        5⤵
        
        PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57493.exe
      4⤵
      PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23978.exe
      4⤵
      PID:10448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45973.exe
      4⤵
      PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        6⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        8⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11780.exe
        9⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        8⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        8⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        8⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12310.exe
        7⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18883.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
        7⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58592.exe
        7⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
        7⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        6⤵
        
        PID:13572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53219.exe
        6⤵
        
        PID:15876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        6⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
        8⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
        8⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
        8⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exe
        7⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        7⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51871.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe
        7⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51719.exe
        7⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        7⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61019.exe
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6742.exe
        6⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
        6⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45759.exe
        6⤵
        
        PID:672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56884.exe
        6⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        6⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51206.exe
        6⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60148.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59291.exe
        5⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        5⤵
        
        PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1772.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
        6⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        7⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39656.exe
        8⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        8⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62423.exe
        8⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        8⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        7⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
        7⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31699.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6332.exe
        7⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        7⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8491.exe
        7⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17402.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56540.exe
        6⤵
        
        PID:13904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49369.exe
        6⤵
        
        PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3038.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62933.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        7⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63575.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-598.exe
        7⤵
        
        PID:17328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35166.exe
        6⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
        7⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32495.exe
        6⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
        5⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17376.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17619.exe
        6⤵
        
        PID:14808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        6⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26254.exe
        6⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55831.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        5⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        5⤵
        
        PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53587.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64599.exe
        6⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
        5⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60276.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe
        5⤵
        
        PID:15908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29847.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe
        5⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        6⤵
        
        PID:13012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        5⤵
        
        PID:11128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
        5⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        5⤵
        
        PID:16176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56662.exe
      4⤵
      PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30661.exe
        5⤵
        
        PID:12368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18243.exe
      4⤵
      PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52712.exe
      4⤵
      PID:14496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9732.exe
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2729.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37600.exe
        6⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6012.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        9⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
        9⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
        9⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61228.exe
        8⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        8⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        7⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46972.exe
        6⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44181.exe
        7⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
        7⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        7⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        6⤵
        
        PID:12504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38129.exe
        6⤵
        
        PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52717.exe
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62764.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        6⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46284.exe
        6⤵
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        6⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51871.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3349.exe
        5⤵
        
        PID:11108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
        5⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12404.exe
        5⤵
        
        PID:15604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50531.exe
        5⤵
        
        PID:15320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        5⤵
        
        PID:5232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 488
        6⤵
        Program crash
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35643.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5388.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43855.exe
        6⤵
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        5⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe
        5⤵
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        5⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3667.exe
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        5⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24903.exe
        5⤵
        
        PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10947.exe
      4⤵
      PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35938.exe
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
      4⤵
      PID:14676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9307.exe
      4⤵
      PID:6272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9063.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        5⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26765.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19013.exe
        7⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe
        7⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32111.exe
        6⤵
        
        PID:16608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
        5⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44604.exe
        5⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59774.exe
        5⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44366.exe
        5⤵
        
        PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40915.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15992.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        6⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        6⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33170.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        5⤵
        
        PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
      4⤵
      PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27790.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        5⤵
        
        PID:7488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
      4⤵
      PID:10156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37765.exe
      4⤵
      PID:13668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3334.exe
      4⤵
      PID:8092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58379.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26848.exe
      4⤵
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        6⤵
        
        PID:13124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe
        6⤵
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42483.exe
      4⤵
      PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
      4⤵
      PID:12704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34294.exe
      4⤵
      PID:15868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62975.exe
    3⤵
    PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16952.exe
      4⤵
      PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52541.exe
        5⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
        5⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        5⤵
        
        PID:14372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe
      4⤵
      PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
      4⤵
      PID:12708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39903.exe
      4⤵
      PID:6352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe
    3⤵
    PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
      4⤵
      PID:11912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
      4⤵
      PID:14688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49524.exe
      4⤵
      PID:7536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25397.exe
    3⤵
    PID:9356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe
    3⤵
    PID:12676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
    3⤵
    PID:5620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7041.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27616.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56936.exe
        8⤵
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        9⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        9⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5011.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe
        8⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62653.exe
        8⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
        8⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26283.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
        7⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53748.exe
        7⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49561.exe
        7⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
        6⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52536.exe
        8⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe
        8⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        8⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        7⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        6⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        7⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        7⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43444.exe
        6⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe
        6⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14771.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe
        6⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62888.exe
        7⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
        8⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        8⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7716.exe
        8⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        7⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        7⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61108.exe
        6⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58135.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe
        6⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44750.exe
        6⤵
        
        PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59067.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        7⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41484.exe
        7⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3667.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        6⤵
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
        6⤵
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        5⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35938.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43238.exe
        5⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59141.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4455.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15904.exe
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37683.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
        7⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46284.exe
        7⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        7⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        6⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
        7⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29928.exe
        7⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
        6⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        6⤵
        
        PID:15340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        5⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11767.exe
        6⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30661.exe
        7⤵
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3667.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        6⤵
        
        PID:14332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8292.exe
        6⤵
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
        5⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31277.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        6⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27506.exe
        5⤵
        
        PID:15544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
        5⤵
        
        PID:14924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19845.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        7⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        7⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47367.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34042.exe
        6⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        6⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
        5⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60045.exe
        6⤵
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41246.exe
        6⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34122.exe
        5⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        5⤵
        
        PID:13256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
      4⤵
      PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41055.exe
        5⤵
        
        PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe
      4⤵
      PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
        5⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37519.exe
        5⤵
        
        PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47045.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21844.exe
      4⤵
      PID:6668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
        5⤵
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33101.exe
        6⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11684.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63501.exe
        8⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35579.exe
        8⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        8⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9818.exe
        7⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49519.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe
        6⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28421.exe
        6⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38947.exe
        6⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
        5⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63894.exe
        5⤵
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53411.exe
        5⤵
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22917.exe
      4⤵
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51456.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37683.exe
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        5⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63243.exe
        5⤵
        
        PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        5⤵
        
        PID:14696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62156.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        5⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        5⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35503.exe
        5⤵
        
        PID:15556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51670.exe
      4⤵
      PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45059.exe
      4⤵
      PID:11024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60112.exe
      4⤵
      PID:14864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
      4⤵
      PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20911.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33760.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13780.exe
        5⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29346.exe
        7⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43531.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        6⤵
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        6⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38875.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43811.exe
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
        5⤵
        
        PID:16112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28478.exe
        5⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        5⤵
        
        PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8627.exe
      4⤵
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
        6⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
        6⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        6⤵
        
        PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46028.exe
        5⤵
        
        PID:8248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        5⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        5⤵
        
        PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe
      4⤵
      PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        5⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        5⤵
        
        PID:13144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        5⤵
        
        PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4413.exe
      4⤵
      PID:12748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49670.exe
      4⤵
      PID:7072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60973.exe
      4⤵
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11684.exe
        5⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6332.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
        6⤵
        
        PID:14620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        5⤵
        
        PID:12832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
      4⤵
      PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
      4⤵
      PID:11460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
      4⤵
      PID:6268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        5⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13109.exe
        5⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
        5⤵
        
        PID:17352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26426.exe
      4⤵
      PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe
      4⤵
      PID:12976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9789.exe
      4⤵
      PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
    3⤵
    PID:6940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15132.exe
    3⤵
    PID:9412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
    3⤵
    PID:12696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61636.exe
    3⤵
    PID:15404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe
    3⤵
    PID:15764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        7⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        7⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        7⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        7⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21714.exe
        6⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
        7⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
        6⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12669.exe
        6⤵
        
        PID:15620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        6⤵
        
        PID:13092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
        6⤵
        
        PID:17176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32380.exe
        5⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
        5⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35198.exe
        5⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
        5⤵
        
        PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33605.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44084.exe
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        6⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42188.exe
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        5⤵
        
        PID:13536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
        5⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
        5⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29604.exe
      4⤵
      PID:8828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
      4⤵
      PID:12652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
      4⤵
      PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2732.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20216.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22477.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        7⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        7⤵
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12494.exe
        6⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
        6⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        5⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14199.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        6⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
        6⤵
        
        PID:17404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37779.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52124.exe
        5⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48793.exe
        5⤵
        
        PID:15388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
      4⤵
      PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        5⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        5⤵
        
        PID:13076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33318.exe
      4⤵
      PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52712.exe
      4⤵
      PID:14432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27964.exe
      4⤵
      PID:14744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62140.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
      4⤵
      PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:64
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
      4⤵
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
      4⤵
      PID:12792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52118.exe
      4⤵
      PID:15084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe
    3⤵
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
      4⤵
      PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59030.exe
        5⤵
        
        PID:15336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
      4⤵
      PID:10276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20235.exe
      4⤵
      PID:15472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
      4⤵
      PID:5960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19675.exe
    3⤵
    PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60597.exe
      4⤵
      PID:15468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
    3⤵
    PID:11336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
    3⤵
    PID:3580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
    3⤵
    PID:7296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59491.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
        5⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56809.exe
        8⤵
        
        PID:15516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        7⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        7⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7979.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10327.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5573.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32799.exe
        6⤵
        
        PID:15144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        5⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        5⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10327.exe
        6⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        6⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49716.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
        5⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54827.exe
        5⤵
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-69.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-69.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26171.exe
        5⤵
        
        PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49470.exe
      4⤵
      PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35646.exe
      4⤵
      PID:14416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
      4⤵
      PID:15580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
      4⤵
      PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24850.exe
        6⤵
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42591.exe
        6⤵
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
        5⤵
        
        PID:12728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38419.exe
      4⤵
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exe
        5⤵
        
        PID:16568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
      4⤵
      PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
      4⤵
      PID:12896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32045.exe
    3⤵
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
      4⤵
      PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        5⤵
        
        PID:13136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        5⤵
        
        PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44575.exe
      4⤵
      PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
      4⤵
      PID:12772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
      4⤵
      PID:16208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15171.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
      4⤵
      PID:8824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
      4⤵
      PID:12984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
      4⤵
      PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17186.exe
    3⤵
    PID:10068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe
    3⤵
    PID:13520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1772.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
        5⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        5⤵
        
        PID:13028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
      4⤵
      PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60084.exe
      4⤵
      PID:11928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3402.exe
      4⤵
      PID:15496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
      4⤵
      PID:2632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
    3⤵
    PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42344.exe
      4⤵
      PID:9820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26747.exe
      4⤵
      PID:13372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
      4⤵
      PID:7160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58603.exe
    3⤵
    PID:10148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
    3⤵
    PID:13676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe
    3⤵
    PID:4116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34251.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34251.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe
    3⤵
    PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2079.exe
      4⤵
      PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
      4⤵
      PID:11372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28770.exe
      4⤵
      PID:15328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
      4⤵
      PID:5884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57267.exe
    3⤵
    PID:8096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
    3⤵
    PID:11996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60011.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
    3⤵
    PID:2860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47285.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47285.exe
  2⤵
  PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
    3⤵
    PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe
      4⤵
      PID:10260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5931.exe
      4⤵
      PID:15544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
      4⤵
      PID:6168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28747.exe
    3⤵
    PID:9544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60763.exe
    3⤵
    PID:13300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3414.exe
    3⤵
    PID:15320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
    3⤵
    PID:6464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22122.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22122.exe
  2⤵
  PID:8024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
  2⤵
  PID:9364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
  2⤵
  PID:14704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62773.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62773.exe
  2⤵
  PID:5656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5232 -ip 5232
1⤵
PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 11404 -ip 11404
1⤵
PID:15568

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe

Filesize
468KB

MD5
09e32dfdc2b48143f5d476a31372fbf0

SHA1
bcf37861d6ce44de4531e5f79e49e030696edc61

SHA256
d816a68c0ea4b988c8ded6ce9e451a50d323faf92bf4644fafe53fa8e042f89a

SHA512
229a68496c08c3a7a5cde1cae0437c076a38963f8c4717207fff444b33adc53e908e70ab2edfaaa8816061e34c88d508fcb8c6692dcb8584cb7978284d6fbc41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe

Filesize
468KB

MD5
0f530cb9adf46f37b497d50d869a9d0e

SHA1
6bb8e8cfd1ee8a7036c7e0d0d4ca05669f4c0218

SHA256
37cd844ab63f0565f05a3219670f180400e8fe4333ea52c6d51b65ff350832cb

SHA512
78550ff243756502323d4bb7b54870abcedb09d32a55231e83118795846782232643d067e494457483668107f5f4efc843c24c980bd3241c1ac80b321e306a0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20911.exe

Filesize
468KB

MD5
4b3df6ba585922edbec4dba983b7a6e4

SHA1
a609d35429f3774751d898df6101db2fc1d6c113

SHA256
2be87b5190a17930799b9ab23cc93171642df1b44e6644506b239efb9b4dae7b

SHA512
35783b5c86ba6bb7398a5eab71e5b93cd7c081ba7547a055db99699572dc595df18db6c41cd1e93bd4f55d7350ba95588926a0749547653bb8b6770003875f6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe

Filesize
468KB

MD5
cba126340655d89adbdcea3fea3c886b

SHA1
7124689097333409c0bbb8dc9e02c5fc3c709850

SHA256
335a0048b7e78f3b0359225f3f698e779e1c834e97b62a09c3e30971603a1240

SHA512
e29c95cf2f1a7c294239a57348d024042d9ded3c0fbddef2acdc8588e7624e916274b876493da3ec5b5812232ab3d04e63ed6d081fd478f69d35bd8f5bf172ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe

Filesize
468KB

MD5
c0b18442b359fd617ef5c02ff9a5843f

SHA1
9863b712ac61f5b0ea1e732bd3c7ad840467fbc4

SHA256
7b3c352cc8cfb088e7b737ea1551f531a6f80fad129c77c7efebb5fe20dae15f

SHA512
ca470c9480284be2c7e38210907f5c03b876cca31bab292bdbd4287275e6cfc2f14d49060129c888f683784fd4e5fa9b2b1b91f239736d52d921ce65a3a570d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26170.exe

Filesize
468KB

MD5
206365a7a2f326e09e2ce9a07e6e7d65

SHA1
8ae3621ae889f665fa8927e82d4947a7ce8a2973

SHA256
f37570c056dd47bd98b80f23c3aedd69bd43ae08774326dca3d27c791e0c999a

SHA512
87bf5396cb008fbd005b39ce44c73961a051d7d46cc1ef2ed721fd559e8d2f961baa3f9b8e996199c9f50699c5aae0bbb4fe5055e7c9fcb0601ccec25465f61e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26570.exe

Filesize
468KB

MD5
4fe365f2f600d4b7976259f78fc46615

SHA1
7fc64f568699c6e4aeb13b5274b58d1fcb385ea2

SHA256
ea4727604d0bd216ce093dcc40faa4360ecf680da2d02aa5ecba35cfb5ca0fc7

SHA512
c028b6f4f2c8812abbd035ef75c1cc900ede96d263eb6fd1d7a2c9bc4c1be0ac7c10fdc8e72c3e04623e3ddd577abb6401cc85dda2382dad214b945b828e13f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26746.exe

Filesize
468KB

MD5
2fd528f6282151258189b73dfb3aaf9e

SHA1
c6fa45d431c934fc84ff0667783af0de599bc594

SHA256
baa93e40a249ceccc1a4de5528d3281571d4072ea7aff5be86e65dbf8bc04753

SHA512
e4c92feff9f891784f7d5a52cbeca6c5dbcbea8a98b9213200b14a3cd3faa9548423c2a7e68020bc18b113e3703b9812b00e7afa7dead7b496a9ca230b573cb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe

Filesize
468KB

MD5
738d3760821c84a73f46697ed6b1ee28

SHA1
f7e2e81b8ff611b17ced1f12b6ba1fdbcb672dea

SHA256
289b5586e719b5324c81ddfbb13dd7bb6b1c5c149baa659141813ce5a0aa8237

SHA512
6ff7ca8f5b769805d9d53f3d2049975fa3db1f4a4cd368da5c1a7de86f28dbcb0e13febcb9089476fe332a6fb60f763918d7ef6cf9f0bfbe705eaa5f0c80a293

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe

Filesize
468KB

MD5
c79f0aa0e4c4d0780e16e20a917c3a4b

SHA1
ec334c9503f1d7d237aacf303b8d8266c6c29dfc

SHA256
c1e06400eabd639543b6e29d303a022072c1052429742dfc0b2e2978eeb9ef80

SHA512
20041e9fb7dba3b65cb67897ea115c5dd663b4e6041cc19ff439e647484af62e368c17c5e59bf46f4f41e1cfb6a0307b67189f0d61844baf55c899903f1199d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2729.exe

Filesize
468KB

MD5
8740307a9805cfb5ec4eb9a139828506

SHA1
576adcd21e0ad8d7a035731f0e4e5c7008524da0

SHA256
c3bf039d7fa106dea0c1be158513b14d8a1f8402da9e320588f4534c7a0b5ff2

SHA512
44aab5b042c84b04096e55ec899146587caba5c270ca65236972722de0bdef42302fb621aa83c9f5978b52fd333deaccc8f44dfbf07d8db10067fd2bb29e579a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28193.exe

Filesize
468KB

MD5
58ffe8d7310ef5063af6af6626e8d6c1

SHA1
5b14d8153a556c9d017be095f21eff7acc8b7ff3

SHA256
38245e8bdd5da53bf123734de4a8e2800291a6b3c86dc196b708950135313d3b

SHA512
64afc9f8d243afc36614e95deb6e00e8e834e11bb60d3d1c8c1362f5a49811cf76b557c4f67bd24d8f9dfa8c98f73bdbae0fbc989a57c87a4d53b172ff67db7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30231.exe

Filesize
468KB

MD5
a05dbb5c4bd9fbeeb7b0cae2728cca29

SHA1
683e240fce1ab7133050854ee437e67a5beafda3

SHA256
da6c8ea93674fcc2a0d31cc5afcf89fec3c625ea7ccf9a08c9a3b1cf68e497f0

SHA512
11319852c950401d8f374d16d44cc97ca90eb52a39db7fa814f382f49245b8b7a939902cb11e988c137f7294cfbbcf9864f2177b5700b184914f37f001a2333a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe

Filesize
468KB

MD5
acd971f3df5319439019689adedb643e

SHA1
396234dc31aa34074ae2f6834fbc931620345c99

SHA256
eef51c52d37c3416e14cff3b1261ac7fdfff6353644fcab592414f8e844a15d4

SHA512
728a600063711a981a6edc1e46f1eae8b8e9052b70d5237639db64bfbb7e33485203629908edc202e494c41e8d975d504cf405542d7bc63f62c107304a32ecab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe

Filesize
468KB

MD5
a888fb99d75ebf9db90293e44d3e80d2

SHA1
d4651bc685cf517a07914f424dca48f07f2c7034

SHA256
a5860695cad66e4de0333d682fbdb3a0c90ecaa7cc301593fe3b7b9150081e41

SHA512
559a78f089aefe52962c522fe7ed601ea4a855af48fabdf42ca6d861cc984c8a937ccd094740e79c8fab394d4d443b5699bcab3385d1ec7400a8143f74e40ef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe

Filesize
468KB

MD5
5f382d957cde051951affa4e1753d5dc

SHA1
c2f7d46e6a2c737d26cdae5a03a7ef844c9c7763

SHA256
4f9c08511b61ed65c2d7bd4d445c2e379933d4d1f784c0650f798ad7481b9d2d

SHA512
e76ded669e3efeadf9a46779b4248cdb15b552e885bdb3366e9934203b583286152a0aa904577d07dbba7aec7ebfcb7847c9f2ee0918adfb710523a9d87ac290

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe

Filesize
468KB

MD5
a9e8054ca55e120da5d94285e86f2415

SHA1
accd5f8661fe474bb01f6722f8adc66a55d983d9

SHA256
97193fca24e9a04331b924088c5f3ae58ec99968915629345b84c1e94c29c5cc

SHA512
45af659b53952aea5709345852e08799d7b6776b519e067ad3c94f9f4f39ba92b79d87e0c12d89842ac09d2b43b8a0429270425b279d720c8b112c73ab541ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46154.exe

Filesize
468KB

MD5
ea9a55869d7745be6c5eb470aca86414

SHA1
4f01025c651c41614d1b0995efe2cbfc02d33988

SHA256
38ae8b8b90c8d6e2b6d8eb54e0a9c431d7c54fd5e026e7c93746d3a062a596e0

SHA512
9214728cc79fbaf2b36b3362f16750a7c257846911da6650c46cdc26ce1284c4119003df4e054d1e73befa6bae0e6b5d36afea88de0524b282ee74e840a56afc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe

Filesize
468KB

MD5
0d04eb3b3212cdb19643d13350faa2b5

SHA1
4b58f38e57daf67e2196982526d1635a430d3213

SHA256
b13213462d7e24a3ea75f50def7772ae029fde083c49cbe73660adf0f0de28d1

SHA512
ebe11de1821ef16eada01f9c25c055460d3f6c58e94b65b1c95c861f491aaef031cae5be75d03d67a0353f2e5b36137059e90ee0614690cc65fa4ada7e7d0023

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe

Filesize
468KB

MD5
bdce33762f61bc92e4a8e4f3d9736d63

SHA1
c1121a5ef8c0812d475ea0c26fce4b7cfbcd4ff0

SHA256
221dc195741e7e28da8ee672cc4e084f9a8f86325cbdd732df0bfa202cf857c0

SHA512
f069f26d155c68178026b7e22073c868ff7c691499e08f32984e93a81b2a7123569c01cb8eb325a6e2e3f728162c9ce3be6b814fc62a8415c46cee3d92fbf84f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe

Filesize
468KB

MD5
4ce3f63143b140909bafa304ec99937c

SHA1
0192ddfcee7a3f0f243ba900c407ed0136e93875

SHA256
23022204d002de6cfb36d6cef119a63a845fd06c57bf6b1810a8866eaa24c09e

SHA512
d10f3befc95ebf7816de52c8773ade20333fd8b6d372139c9deba00fefdfe5c578d8a06f12107e65550cba043b36cdc9071d6170fb6bfa8e5a0f85967d19f253

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe

Filesize
468KB

MD5
882856bcf90b7ca812ecc6b89b69c7b7

SHA1
6ffd6c8eb8b223d482e3e95bd36c8d91e6912178

SHA256
c442f57f071cea196cb47d1c09b072f5255119fd59ae1ffa6c4eecc1db589458

SHA512
0b3ddb42ea4e8891c8407fc94e206ea2b8f583ae080564c52c3e9d7f6efde1aef859fe1669a655a270746591b2d9f980a622c6f7fab32331d2bf70f19148d35e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe

Filesize
468KB

MD5
7c1219ecb281ce2b0a64437d09bb3358

SHA1
b562e3d74d81d5baff218c6015a5002914a437d1

SHA256
84ecb29730d78cf7a5dcc6ab46233fe1efc854f9a82ae44972e0d0aa4a2f4c58

SHA512
5a7a4f34f6bcfe48877ee19fa7e0fcbac405a747ee31ef67fc9d3f91ef4c24637470f4afe91859e44acba8a5d01fb8147eccc12abe40f741c7cee71686460a69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe

Filesize
468KB

MD5
fe9f9f290ad423fba290784d1f2579cf

SHA1
db8876ced5abf2a90a467a4991dca372660e61e7

SHA256
8593360af7de9b87a45573ca83c30ee988085e0fc5584c55b09869bea38ed2fd

SHA512
3aac6b4a4b68db6d4ac5f2fd95804398e25e53080891cfbdbe140517be1876f088f088f2dff50191851bdb89c47b611bdf9f54b7c5bc9efd8f0842616dde0a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe

Filesize
468KB

MD5
e0844e3514c585557562706e3adc670f

SHA1
fd07d5064b0f14b31676e1cc25400b09fcc37923

SHA256
72df0d7679122f8c08bbd66564ddb23c3da80c0740efba926da61ab3546ccf8a

SHA512
33ca325cd2f5313bc18e379167f764e00fd124af7ed43c71aa84bc7de767dbee55db446eae16452665eb169061286a657cad832310c68fdbd1d56d03dd2a4d7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6320.exe

Filesize
468KB

MD5
18c8c8d3c1eb6c9932918d0d6d4ecf0b

SHA1
5672463528f7fb9b2e79e1b46952e6c2d443bbb4

SHA256
abbd7aa76b8069d88ac9250d2ea929e9646713e7cc4c767f025910f77dfcf33c

SHA512
6379e469f4b887fc4e10aa448fce6f66da5bcfc32b57223bdddb1f90e91db8ed0671d135a74ac9dc1ab1e3fd645e8b55a74f45f71d0572e7b71bf41724ea9c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe

Filesize
468KB

MD5
5bd63d83060682e5d3f08b5132285ead

SHA1
ce4662b3672b19088011eec5538eae250a3150ec

SHA256
b2783cf0361776ac17862cb902589047794ac6ecf2af117eb9ed00739c40f26e

SHA512
4ddbbb8c8d98fd7ea493515c38dc71f67224fc4378a9e238cc9d7dd93cbcc80a9715a39a8cf6f1d1ca5d104e661318ca72942fbeef0d36bff9db9a67708b09f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe

Filesize
468KB

MD5
fb0fe974cde2da10b4c04aba615d586e

SHA1
78cf69b1ca8673e04ba32e9035e5dba45129ea0c

SHA256
7234b13b796865a9fbc794ccf0dc7c0ef46c3bdaa04c5e525eba6b3ed6973ccf

SHA512
c387d214cafb46fad86713511a1ea40961f6be590ee58ddf8c80bb6c2e4dbd19d111c507a3b7efdac27db7e877b50191e6f644c714863cec790cc79e67ff7f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe

Filesize
468KB

MD5
eff73a8db0885e531ea2d415f641a9dd

SHA1
121c70be44d16841d46cda9948ab475b2c843ec1

SHA256
efd166fd85a52756907374f307b7219b2613df51f2c6a2a5d4eb2abbeca40011

SHA512
7faedc003b699686cc97cb610bb2ada7f686cca489f8cd8aa11802f52fe9df4a79eb3c242985eac54dba6444eef2140693fe3312a7dece11778c89d420892261

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7041.exe

Filesize
468KB

MD5
2f03d08b63dbb3d3cbb5255df38f62e0

SHA1
6bc2c213a31402c1cb26e16c93be3b7f24bf0e84

SHA256
8f6369f2c05c29c1bbc89bfb976bdb9e196ff950ba468dc4dda60637d7cbc059

SHA512
35c80a21014a4525515639ef9a28b3c6534184b5fb0a828071267e3d463fc60bc46549c8d83eca028b1be32376400a1fe7c17c59e598f8121abe0604763934e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe

Filesize
468KB

MD5
6a87c4a32e5c4eaccc5c88a3cad18a47

SHA1
d9b18e5e33ca182044c3d2d203a569e5fd936cf1

SHA256
d84e0e8dc4786608ec6e3c8a00c7bbb9293334eaf7fcbfb686c06eca9c783ab3

SHA512
b1b1a5c68f4c903a5b5d1075321c1481ece1c75042a5abfda4c4d292d7e192349832c35448c17854571e46b5cda8a402fe4e122be26f2e9ae5ecbcb2329ca604

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7233.exe

Filesize
468KB

MD5
ca565e64e2e78b3c0a5ff7d5471a3d95

SHA1
3297caa7d6cdb8b45487015801f4502c53a81f8d

SHA256
21a96d0fcd3915ef64a095cc806fdc2fdd098f025fba2073face067f18200c48

SHA512
c2058379becec6cd54d1e1e654aca045151ffcf2e847d67e0841b1a6988eada4d822f1adbe50d680db42de6921ef23259821f2426381aa9c52939fbf25293927

Download Submit
memory/232-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/564-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/716-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/748-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/772-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/812-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1112-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1132-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1136-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1184-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1376-2827-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1404-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1448-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1844-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2156-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3000-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3088-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3156-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3436-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3472-115-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-2641-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3500-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3524-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3628-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3632-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3732-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3800-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3876-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3912-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4028-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4060-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4224-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4276-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4300-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4392-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4500-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4640-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4720-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4916-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5188-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5260-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5276-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5304-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5364-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15572-2715-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads