c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4

Analysis

max time kernel
118s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe
Size

468KB
MD5

efcddf2f3ed7f9cf8ec8eb3f7ac6da50
SHA1

d7f5887206963f9a92fc9ca04e367efa948db174
SHA256

c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4
SHA512

35abdb347d4d6dcf1d8b6a36301219ca3b9b918b458496552e2eec82807320af13f922bd5937ccd413ae6e0db1d8b11573c8821d2370c355acc8b2fa529bea05
SSDEEP

3072:ibzoogIdId5UtbYHPztjcf8/sClvN3prYmHegVhtRAP8cEVuGelz:ibcowbUtoPJjcfEZGsRAEFVuG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
212	Unicorn-57978.exe
2336	Unicorn-9929.exe
60	Unicorn-23805.exe
2272	Unicorn-42326.exe
1976	Unicorn-62192.exe
5032	Unicorn-20182.exe
1428	Unicorn-26313.exe
1072	Unicorn-34263.exe
940	Unicorn-54775.exe
1136	Unicorn-28041.exe
840	Unicorn-49530.exe
2720	Unicorn-14719.exe
4992	Unicorn-12259.exe
4996	Unicorn-34875.exe
376	Unicorn-1953.exe
2124	Unicorn-33277.exe
5060	Unicorn-33012.exe
4700	Unicorn-61543.exe
1464	Unicorn-56219.exe
1396	Unicorn-21715.exe
3712	Unicorn-51066.exe
4128	Unicorn-26047.exe
2800	Unicorn-49997.exe
4868	Unicorn-49997.exe
4328	Unicorn-29476.exe
1204	Unicorn-35607.exe
4448	Unicorn-15741.exe
1880	Unicorn-45913.exe
1336	Unicorn-56119.exe
3256	Unicorn-42383.exe
3304	Unicorn-14563.exe
1324	Unicorn-30153.exe
4032	Unicorn-34237.exe
1440	Unicorn-62503.exe
4644	Unicorn-7901.exe
2404	Unicorn-10701.exe
5020	Unicorn-53095.exe
1680	Unicorn-35690.exe
1984	Unicorn-36266.exe
4456	Unicorn-28652.exe
3556	Unicorn-941.exe
4256	Unicorn-64962.exe
4944	Unicorn-53479.exe
116	Unicorn-24790.exe
5096	Unicorn-48326.exe
1240	Unicorn-17600.exe
2616	Unicorn-65430.exe
2612	Unicorn-63384.exe
2156	Unicorn-3712.exe
2440	Unicorn-37719.exe
3972	Unicorn-21937.exe
4792	Unicorn-20048.exe
2324	Unicorn-20314.exe
1476	Unicorn-38273.exe
4904	Unicorn-15160.exe
4920	Unicorn-19245.exe
808	Unicorn-2808.exe
3764	Unicorn-11631.exe
2808	Unicorn-4854.exe
3516	Unicorn-54610.exe
3464	Unicorn-41611.exe
4156	Unicorn-62123.exe
2240	Unicorn-32591.exe
2264	Unicorn-20662.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
9672	6668	WerFault.exe	260
12520	6836	WerFault.exe	278
13432	6836	WerFault.exe	278
16140	12896	WerFault.exe	725

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60021.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
16192	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15756	dwm.exe
Token: SeChangeNotifyPrivilege	15756	dwm.exe
Token: 33	15756	dwm.exe
Token: SeIncBasePriorityPrivilege	15756	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe
212	Unicorn-57978.exe
2336	Unicorn-9929.exe
60	Unicorn-23805.exe
2272	Unicorn-42326.exe
1976	Unicorn-62192.exe
5032	Unicorn-20182.exe
1428	Unicorn-26313.exe
1072	Unicorn-34263.exe
940	Unicorn-54775.exe
4996	Unicorn-34875.exe
1136	Unicorn-28041.exe
840	Unicorn-49530.exe
2720	Unicorn-14719.exe
4992	Unicorn-12259.exe
376	Unicorn-1953.exe
2124	Unicorn-33277.exe
5060	Unicorn-33012.exe
4700	Unicorn-61543.exe
1464	Unicorn-56219.exe
1396	Unicorn-21715.exe
3712	Unicorn-51066.exe
1336	Unicorn-56119.exe
1880	Unicorn-45913.exe
4128	Unicorn-26047.exe
4448	Unicorn-15741.exe
2800	Unicorn-49997.exe
3256	Unicorn-42383.exe
4328	Unicorn-29476.exe
1204	Unicorn-35607.exe
4868	Unicorn-49997.exe
3304	Unicorn-14563.exe
4032	Unicorn-34237.exe
1324	Unicorn-30153.exe
1440	Unicorn-62503.exe
2404	Unicorn-10701.exe
4644	Unicorn-7901.exe
5020	Unicorn-53095.exe
1680	Unicorn-35690.exe
1984	Unicorn-36266.exe
4456	Unicorn-28652.exe
3556	Unicorn-941.exe
4256	Unicorn-64962.exe
4944	Unicorn-53479.exe
116	Unicorn-24790.exe
5096	Unicorn-48326.exe
2616	Unicorn-65430.exe
1240	Unicorn-17600.exe
2156	Unicorn-3712.exe
2440	Unicorn-37719.exe
2612	Unicorn-63384.exe
4792	Unicorn-20048.exe
1476	Unicorn-38273.exe
3972	Unicorn-21937.exe
4920	Unicorn-19245.exe
2324	Unicorn-20314.exe
2808	Unicorn-4854.exe
4156	Unicorn-62123.exe
3516	Unicorn-54610.exe
3764	Unicorn-11631.exe
3464	Unicorn-41611.exe
4904	Unicorn-15160.exe
808	Unicorn-2808.exe
3732	Unicorn-9286.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 212	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	82
PID 5084 wrote to memory of 212	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	82
PID 5084 wrote to memory of 212	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	82
PID 212 wrote to memory of 2336	212	Unicorn-57978.exe	85
PID 212 wrote to memory of 2336	212	Unicorn-57978.exe	85
PID 212 wrote to memory of 2336	212	Unicorn-57978.exe	85
PID 5084 wrote to memory of 60	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	86
PID 5084 wrote to memory of 60	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	86
PID 5084 wrote to memory of 60	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	86
PID 212 wrote to memory of 2272	212	Unicorn-57978.exe	90
PID 212 wrote to memory of 2272	212	Unicorn-57978.exe	90
PID 212 wrote to memory of 2272	212	Unicorn-57978.exe	90
PID 2336 wrote to memory of 1976	2336	Unicorn-9929.exe	89
PID 2336 wrote to memory of 1976	2336	Unicorn-9929.exe	89
PID 2336 wrote to memory of 1976	2336	Unicorn-9929.exe	89
PID 60 wrote to memory of 1428	60	Unicorn-23805.exe	91
PID 60 wrote to memory of 1428	60	Unicorn-23805.exe	91
PID 60 wrote to memory of 1428	60	Unicorn-23805.exe	91
PID 5084 wrote to memory of 5032	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	92
PID 5084 wrote to memory of 5032	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	92
PID 5084 wrote to memory of 5032	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	92
PID 2272 wrote to memory of 1072	2272	Unicorn-42326.exe	94
PID 2272 wrote to memory of 1072	2272	Unicorn-42326.exe	94
PID 2272 wrote to memory of 1072	2272	Unicorn-42326.exe	94
PID 212 wrote to memory of 940	212	Unicorn-57978.exe	95
PID 212 wrote to memory of 940	212	Unicorn-57978.exe	95
PID 212 wrote to memory of 940	212	Unicorn-57978.exe	95
PID 1976 wrote to memory of 1136	1976	Unicorn-62192.exe	98
PID 1976 wrote to memory of 1136	1976	Unicorn-62192.exe	98
PID 1976 wrote to memory of 1136	1976	Unicorn-62192.exe	98
PID 1428 wrote to memory of 840	1428	Unicorn-26313.exe	99
PID 1428 wrote to memory of 840	1428	Unicorn-26313.exe	99
PID 1428 wrote to memory of 840	1428	Unicorn-26313.exe	99
PID 5032 wrote to memory of 2720	5032	Unicorn-20182.exe	100
PID 5032 wrote to memory of 2720	5032	Unicorn-20182.exe	100
PID 5032 wrote to memory of 2720	5032	Unicorn-20182.exe	100
PID 2336 wrote to memory of 4992	2336	Unicorn-9929.exe	101
PID 2336 wrote to memory of 4992	2336	Unicorn-9929.exe	101
PID 2336 wrote to memory of 4992	2336	Unicorn-9929.exe	101
PID 5084 wrote to memory of 4996	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	102
PID 5084 wrote to memory of 4996	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	102
PID 5084 wrote to memory of 4996	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	102
PID 60 wrote to memory of 376	60	Unicorn-23805.exe	103
PID 60 wrote to memory of 376	60	Unicorn-23805.exe	103
PID 60 wrote to memory of 376	60	Unicorn-23805.exe	103
PID 1072 wrote to memory of 2124	1072	Unicorn-34263.exe	104
PID 1072 wrote to memory of 2124	1072	Unicorn-34263.exe	104
PID 1072 wrote to memory of 2124	1072	Unicorn-34263.exe	104
PID 212 wrote to memory of 5060	212	Unicorn-57978.exe	105
PID 212 wrote to memory of 5060	212	Unicorn-57978.exe	105
PID 212 wrote to memory of 5060	212	Unicorn-57978.exe	105
PID 2272 wrote to memory of 4700	2272	Unicorn-42326.exe	106
PID 2272 wrote to memory of 4700	2272	Unicorn-42326.exe	106
PID 2272 wrote to memory of 4700	2272	Unicorn-42326.exe	106
PID 4996 wrote to memory of 1464	4996	Unicorn-34875.exe	107
PID 4996 wrote to memory of 1464	4996	Unicorn-34875.exe	107
PID 4996 wrote to memory of 1464	4996	Unicorn-34875.exe	107
PID 5084 wrote to memory of 1396	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	108
PID 5084 wrote to memory of 1396	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	108
PID 5084 wrote to memory of 1396	5084	c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe	108
PID 1136 wrote to memory of 3712	1136	Unicorn-28041.exe	109
PID 1136 wrote to memory of 3712	1136	Unicorn-28041.exe	109
PID 1136 wrote to memory of 3712	1136	Unicorn-28041.exe	109
PID 1976 wrote to memory of 4128	1976	Unicorn-62192.exe	110

C:\Users\Admin\AppData\Local\Temp\c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe
"C:\Users\Admin\AppData\Local\Temp\c05a84bee9a5265dc0404b8c938d1cb740de48b58d59c181030c17d596a3aaf4N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51066.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        9⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27115.exe
        10⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13658.exe
        10⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe
        10⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
        9⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        9⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54084.exe
        9⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        8⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20400.exe
        9⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
        9⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        9⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
        8⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38984.exe
        8⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
        8⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34044.exe
        7⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        8⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9701.exe
        9⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45366.exe
        10⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
        10⤵
        
        PID:18240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        9⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43128.exe
        9⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23270.exe
        9⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46015.exe
        9⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2868.exe
        8⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe
        8⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
        7⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
        8⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
        8⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        8⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe
        7⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46179.exe
        7⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38066.exe
        7⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28652.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6554.exe
        10⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        10⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
        9⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exe
        9⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15940.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        8⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20588.exe
        7⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64390.exe
        8⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
        8⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exe
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        8⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28516.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9410.exe
        7⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        6⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6092.exe
        8⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        8⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
        8⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8260.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        7⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17521.exe
        6⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        7⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        7⤵
        
        PID:17060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14106.exe
        6⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49607.exe
        6⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48326.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
        7⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17403.exe
        8⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
        9⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
        9⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14804.exe
        9⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62096.exe
        8⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57243.exe
        8⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        8⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        8⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        8⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        8⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        7⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46999.exe
        7⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36156.exe
        6⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        7⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        7⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13440.exe
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28589.exe
        6⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55513.exe
        6⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63384.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27159.exe
        6⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45415.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        8⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24483.exe
        8⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21768.exe
        8⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        8⤵
        
        PID:17196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1821.exe
        7⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe
        7⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30115.exe
        7⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
        7⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        7⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62916.exe
        6⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3637.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28046.exe
        5⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3871.exe
        6⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11790.exe
        6⤵
        
        PID:16816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7487.exe
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        5⤵
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
        5⤵
        
        PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12259.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15160.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe
        8⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        8⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        8⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5071.exe
        8⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        7⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        7⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
        7⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42186.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        7⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-249.exe
        7⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        6⤵
        
        PID:12760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3637.exe
        6⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54610.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
        8⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        8⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5074.exe
        8⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43307.exe
        7⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24738.exe
        6⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        7⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        6⤵
        
        PID:11792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24799.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
        6⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
        5⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-280.exe
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        6⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        5⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        5⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        5⤵
        
        PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56119.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17600.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21277.exe
        8⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        8⤵
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22445.exe
        8⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        7⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe
        7⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48198.exe
        7⤵
        
        PID:17604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56167.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51126.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        7⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        6⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8758.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        5⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
        5⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45053.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3712.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe
        7⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42050.exe
        7⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe
        6⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
        6⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27853.exe
        5⤵
        
        PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
        5⤵
        
        PID:11044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        5⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19380.exe
      4⤵
      PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56580.exe
        5⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        5⤵
        
        PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45229.exe
      4⤵
      PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30063.exe
        5⤵
        
        PID:14944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
      4⤵
      PID:5080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30153.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58269.exe
        8⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43360.exe
        9⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6836 -s 628
        10⤵
        Program crash
        
        PID:12520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6836 -s 636
        10⤵
        Program crash
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        9⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
        9⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        9⤵
        
        PID:16324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61211.exe
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11588.exe
        9⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51794.exe
        8⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21281.exe
        8⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        8⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42186.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        8⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53492.exe
        7⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
        7⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        7⤵
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9841.exe
        6⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        8⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        9⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57051.exe
        8⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32228.exe
        7⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
        7⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        7⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12666.exe
        7⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57986.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56540.exe
        6⤵
        
        PID:14812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62503.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22608.exe
        6⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58580.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8127.exe
        9⤵
        
        PID:17652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
        8⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        8⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64734.exe
        8⤵
        
        PID:17672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63221.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        8⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30379.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        7⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9216.exe
        7⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
        7⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42050.exe
        7⤵
        
        PID:14472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53492.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        6⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
        6⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
        6⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2087.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        8⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4442.exe
        8⤵
        
        PID:16840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        7⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33778.exe
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25814.exe
        6⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41367.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
        6⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
        6⤵
        
        PID:12856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        6⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26449.exe
        5⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
        5⤵
        
        PID:588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61543.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20662.exe
        6⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51593.exe
        8⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        8⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25478.exe
        7⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
        7⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12534.exe
        7⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4665.exe
        7⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        7⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        7⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53492.exe
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        6⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63842.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
        5⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58269.exe
        6⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        8⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23072.exe
        8⤵
        
        PID:17524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35837.exe
        7⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57121.exe
        7⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10256.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        7⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe
        6⤵
        
        PID:16692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32486.exe
        5⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51126.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        6⤵
        
        PID:16004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58178.exe
        5⤵
        
        PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40920.exe
        5⤵
        
        PID:18168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10701.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54377.exe
        6⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58518.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        8⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        8⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19392.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        7⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60285.exe
        6⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        7⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62159.exe
        7⤵
        
        PID:17736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
        6⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5046.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        6⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        6⤵
        
        PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        5⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46606.exe
        5⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
        5⤵
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46252.exe
        5⤵
        
        PID:17456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22343.exe
      4⤵
      PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        6⤵
        
        PID:17808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        5⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35972.exe
        5⤵
        
        PID:11304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40462.exe
        5⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
        5⤵
        
        PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49398.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
        5⤵
        
        PID:13288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50139.exe
        5⤵
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26529.exe
        5⤵
        
        PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44352.exe
      4⤵
      PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
        5⤵
        
        PID:14376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33909.exe
      4⤵
      PID:12876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
      4⤵
      PID:17048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41611.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        6⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        8⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62159.exe
        8⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        7⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        7⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        7⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
        6⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20702.exe
        6⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22451.exe
        5⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17494.exe
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        6⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59897.exe
        5⤵
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        5⤵
        
        PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16116.exe
        6⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        6⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5071.exe
        6⤵
        
        PID:17188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59220.exe
        5⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11110.exe
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
        5⤵
        
        PID:13996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        5⤵
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        5⤵
        
        PID:11520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        5⤵
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
        5⤵
        
        PID:17512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
      4⤵
      PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20720.exe
      4⤵
      PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
      4⤵
      PID:16032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
      4⤵
      PID:4200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33012.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32591.exe
      4⤵
      Executes dropped EXE
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52662.exe
        7⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        7⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50996.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        6⤵
        
        PID:12568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
        5⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3347.exe
        6⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53799.exe
        6⤵
        
        PID:17628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        5⤵
        
        PID:11580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55922.exe
      4⤵
      PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        5⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        5⤵
        
        PID:13264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        5⤵
        
        PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
      4⤵
      PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43361.exe
      4⤵
      PID:13196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38066.exe
      4⤵
      PID:16152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7901.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe
      4⤵
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58269.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15884.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        6⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        6⤵
        
        PID:17492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        5⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        5⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9503.exe
        5⤵
        
        PID:17792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45010.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18363.exe
        5⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
        6⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47150.exe
        6⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9652.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43128.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47775.exe
        5⤵
        
        PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
      4⤵
      PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        5⤵
        
        PID:12700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62159.exe
        5⤵
        
        PID:17708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8733.exe
      4⤵
      PID:11016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
      4⤵
      PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
      4⤵
      PID:6440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48288.exe
    3⤵
    PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
      4⤵
      PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        5⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54011.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42552.exe
        5⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65184.exe
        5⤵
        
        PID:16700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe
      4⤵
      PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20400.exe
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        5⤵
        
        PID:13496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
        5⤵
        
        PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe
      4⤵
      PID:10884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
      4⤵
      PID:14896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
      4⤵
      PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exe
    3⤵
    PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
      4⤵
      PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
      4⤵
      PID:13392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
      4⤵
      PID:15888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25305.exe
    3⤵
    PID:8376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
    3⤵
    PID:12348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
    3⤵
    PID:3164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49530.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46292.exe
        8⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4665.exe
        9⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        9⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50638.exe
        8⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35972.exe
        8⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4774.exe
        8⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50550.exe
        8⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55568.exe
        8⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        8⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        7⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16849.exe
        7⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34511.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8056.exe
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        8⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        8⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54011.exe
        7⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-368.exe
        7⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65264.exe
        7⤵
        
        PID:17536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46117.exe
        6⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8733.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21251.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
        6⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21937.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38342.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47911.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        7⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        7⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30862.exe
        6⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6420.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56388.exe
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11712.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63648.exe
        6⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22306.exe
        5⤵
        
        PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19245.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63915.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45799.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3295.exe
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        8⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40230.exe
        8⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53844.exe
        7⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
        7⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        7⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35879.exe
        7⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe
        6⤵
        
        PID:12916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64734.exe
        6⤵
        
        PID:18320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40187.exe
        6⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
        7⤵
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22490.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17161.exe
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
        5⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41739.exe
        6⤵
        
        PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30379.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        5⤵
        
        PID:14716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2808.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41881.exe
        6⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        7⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21638.exe
        6⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54983.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-285.exe
        5⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        5⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-987.exe
        5⤵
        
        PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39229.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58884.exe
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
        5⤵
        
        PID:15280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
        5⤵
        
        PID:17580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
      4⤵
      PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
        5⤵
        
        PID:18260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe
      4⤵
      PID:11984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
      4⤵
      PID:12748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34315.exe
        7⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        7⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3155.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28922.exe
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        6⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
        6⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
        6⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64555.exe
        6⤵
        
        PID:15432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe
        6⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53492.exe
        5⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46866.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24593.exe
        5⤵
        
        PID:12556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        5⤵
        
        PID:17480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        5⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9343.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        7⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14093.exe
        7⤵
        
        PID:16952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        6⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        6⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        5⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8038.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47150.exe
        6⤵
        
        PID:15576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        6⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        5⤵
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57925.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        5⤵
        
        PID:17080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18781.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
        5⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
        5⤵
        
        PID:12812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42491.exe
        5⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exe
        5⤵
        
        PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30960.exe
      4⤵
      PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37940.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42204.exe
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
      4⤵
      PID:7520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58077.exe
        5⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39961.exe
        6⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19357.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26320.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64446.exe
        7⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29300.exe
        7⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        6⤵
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
        6⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51592.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        6⤵
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        5⤵
        
        PID:15848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5046.exe
      4⤵
      PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        5⤵
        
        PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
      4⤵
      PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59897.exe
      4⤵
      PID:13160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
      4⤵
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20048.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
      4⤵
      PID:712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52330.exe
        5⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44027.exe
        5⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
        5⤵
        
        PID:15196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
        5⤵
        
        PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42500.exe
      4⤵
      PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46606.exe
      4⤵
      PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
      4⤵
      PID:15592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
      4⤵
      PID:5444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9701.exe
      4⤵
      PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        5⤵
        
        PID:14956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12610.exe
        5⤵
        
        PID:17036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
      4⤵
      PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
      4⤵
      PID:13076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
      4⤵
      PID:13504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23766.exe
    3⤵
    PID:7600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
      4⤵
      PID:11276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
      4⤵
      PID:14724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6273.exe
      4⤵
      PID:15320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-598.exe
    3⤵
    PID:11068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42674.exe
    3⤵
    PID:5316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14719.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45913.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20314.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
        6⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12358.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8666.exe
        8⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
        8⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exe
        8⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13196.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38647.exe
        7⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63458.exe
        6⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44027.exe
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        7⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        7⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
        6⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
        7⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12896 -s 464
        8⤵
        Program crash
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35168.exe
        7⤵
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1455.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        7⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33585.exe
        7⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
        7⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36605.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        6⤵
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43102.exe
        5⤵
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8733.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37587.exe
        5⤵
        
        PID:13568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
        5⤵
        
        PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8684.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe
        6⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        6⤵
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21276.exe
        6⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        6⤵
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        5⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        5⤵
        
        PID:13524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        5⤵
        
        PID:17468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48631.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47911.exe
        5⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        6⤵
        
        PID:13012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe
        5⤵
        
        PID:14756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
        5⤵
        
        PID:16868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33207.exe
      4⤵
      PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        5⤵
        
        PID:15720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8526.exe
        5⤵
        
        PID:16920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21713.exe
      4⤵
      PID:10100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
      4⤵
      PID:14792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
      4⤵
      PID:17156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15741.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39904.exe
        5⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        8⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36839.exe
        8⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        7⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        6⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50000.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        6⤵
        
        PID:17500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20588.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52496.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        6⤵
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43261.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51917.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe
        5⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23882.exe
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
        6⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35609.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        5⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15251.exe
        5⤵
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
        5⤵
        
        PID:15060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41589.exe
      4⤵
      PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53959.exe
      4⤵
      PID:11036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
      4⤵
      PID:14928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54073.exe
      4⤵
      PID:17088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
      4⤵
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        6⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64873.exe
        7⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60363.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12138.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15940.exe
        5⤵
        
        PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
        5⤵
        
        PID:13172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
        5⤵
        
        PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21766.exe
      4⤵
      PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24483.exe
        5⤵
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50357.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61894.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43076.exe
      4⤵
      PID:8256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
      4⤵
      PID:11440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe
      4⤵
      PID:16124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5980.exe
    3⤵
    PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11564.exe
      4⤵
      PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
      4⤵
      PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
      4⤵
      PID:13420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59067.exe
      4⤵
      PID:5620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21191.exe
    3⤵
    PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
    3⤵
    PID:10260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19368.exe
    3⤵
    PID:14516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
    3⤵
    PID:3560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34875.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34875.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56219.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53095.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe
        5⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44987.exe
        7⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47150.exe
        7⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
        7⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29946.exe
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
        6⤵
        
        PID:13104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
        6⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42186.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        6⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9026.exe
        5⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64875.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        6⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
        5⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        5⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20150.exe
        5⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe
        5⤵
        
        PID:16684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
      4⤵
      PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
        5⤵
        
        PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
      4⤵
      PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43361.exe
      4⤵
      PID:13144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27542.exe
      4⤵
      PID:16660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-941.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58679.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
        5⤵
        
        PID:6668
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 720
        6⤵
        Program crash
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47775.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
      4⤵
      PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        5⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
        5⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1997.exe
        5⤵
        
        PID:17560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49573.exe
      4⤵
      PID:9696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe
      4⤵
      PID:13304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61372.exe
      4⤵
      PID:17692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34842.exe
    3⤵
    PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44647.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56580.exe
        5⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        5⤵
        
        PID:12172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
      4⤵
      PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35972.exe
      4⤵
      PID:11488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40462.exe
      4⤵
      PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40189.exe
    3⤵
    PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3871.exe
      4⤵
      PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        5⤵
        
        PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
      4⤵
      PID:13620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
    3⤵
    PID:9152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43361.exe
    3⤵
    PID:13224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe
    3⤵
    PID:2260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21715.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21715.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36266.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
      4⤵
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        5⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        6⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        6⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        5⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38302.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
        5⤵
        
        PID:15724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38447.exe
        5⤵
        
        PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20588.exe
      4⤵
      PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41780.exe
        5⤵
        
        PID:10428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
        5⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22261.exe
        5⤵
        
        PID:16892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
      4⤵
      PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
      4⤵
      PID:13436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe
      4⤵
      PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
    3⤵
    PID:764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64683.exe
      4⤵
      PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17302.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48962.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        5⤵
        
        PID:15800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
      4⤵
      PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38625.exe
      4⤵
      PID:15556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
      4⤵
      PID:2936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6639.exe
    3⤵
    PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
      4⤵
      PID:15724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
      4⤵
      PID:6720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
    3⤵
    PID:11920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34558.exe
    3⤵
    PID:7108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24938.exe
    3⤵
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
      4⤵
      PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19323.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31229.exe
        6⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45531.exe
        6⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57410.exe
        5⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16376.exe
        5⤵
        
        PID:14728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        5⤵
        
        PID:12496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43647.exe
      4⤵
      PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe
        5⤵
        
        PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
      4⤵
      PID:10152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
      4⤵
      PID:3168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20588.exe
    3⤵
    PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
      4⤵
      PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
      4⤵
      PID:2160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20216.exe
    3⤵
    PID:9168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
    3⤵
    PID:11912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
    3⤵
    PID:9200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
  2⤵
  PID:3664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
    3⤵
    PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
      4⤵
      PID:7392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41457.exe
      4⤵
      PID:11072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
      4⤵
      PID:14996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10939.exe
      4⤵
      PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
    3⤵
    PID:7680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24513.exe
    3⤵
    PID:10192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
    3⤵
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5071.exe
    3⤵
    PID:17180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9947.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9947.exe
  2⤵
  PID:6528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57732.exe
    3⤵
    PID:9856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6751.exe
    3⤵
    PID:13716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
    3⤵
    PID:1700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-811.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-811.exe
  2⤵
  PID:8844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31731.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31731.exe
  2⤵
  PID:13088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
  2⤵
  PID:16348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6668 -ip 6668
1⤵
PID:9520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6836 -ip 6836
1⤵
PID:12340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6836 -ip 6836
1⤵
PID:14868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 12896 -ip 12896
1⤵
PID:15980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:16192

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12259.exe

Filesize
468KB

MD5
bd9b3deb3f16d6ea569838f6f8d5e26c

SHA1
5dfe26884f945a0243221d1890dbcd9004564580

SHA256
0bdbda3818bab3e8dfbbb60822654bef373cfb706e751f63a881705c3dcc2eac

SHA512
d58af0bd2025835679326528d1d857f228fb99ee4040cd5966ad145efa761cf2036476b35097791604c938db2c813470a8b6736a05e4e2732679a90731829427

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe

Filesize
468KB

MD5
92c7f9399ff954ba449cf2a21d1e83c5

SHA1
9099803ee73851ac63cda8a8cd6f150fcd568a74

SHA256
c08b39a142877c5b8c5ff49c7f7235ffb53afb1607fb25c47f5b3542d4f7c0aa

SHA512
108324e08a56d0509ff30869d291fb9ebaf1ad349284a60d1cbd30b6f4afa3ac8a990bd24273911e0958b85d34087acbe70eebbe5e90c55de6ab0b873b45408f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14719.exe

Filesize
468KB

MD5
baa1c75fc8cb38e59b824dd79ab263d8

SHA1
a0ba7bae91b4a93749df7ffbd624e31e36faafe1

SHA256
d9345ac4d4df053da7852ab98f37f927bf1ba4396520ea318759e0e63f8dddd3

SHA512
558d0b5b80baf67829b400261754de85d2cac93f8bc5961af21c757114a0ec79951308a2cef3fc45318983bebd9063a9362b5809fa9f4f6a80fc1b9171d989bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15741.exe

Filesize
468KB

MD5
b56a1fb8303bdd7eead905653462c359

SHA1
958965907d00b067e736a8118e00e27bfbbb4ee0

SHA256
65a1eb7ad725f6e144a52cc13959bacb52d60ad182237d905404a180133b3bcf

SHA512
b517db7a79231915a6483a9e676dea3cb34031261b08726fe42b3e74bc39303a9ba23a95664655961d17ad48f7abfbca3172001fc0dae80cf32fada4ba1c9641

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exe

Filesize
468KB

MD5
843f99123422b9b25fa112e44f0318da

SHA1
15105348d27d89aea153aeeef604390602febcb4

SHA256
7d4119bbffd07cde83c764903b43809529766c0b55eb48ae7ee703334cf4d729

SHA512
fe6928fbed73115871fb086c1a978f1c397c1242ec2cf0fb531c9cfe7f16ac8aefa9e014b60f56384cee83eb19c548394424fc55b888542fab016620f961b3fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20182.exe

Filesize
468KB

MD5
8f3f8cc59cc96a387a597f11f4f9b77b

SHA1
6ed947b243f2572f883dc6457f0455200fcf3bd5

SHA256
a76fa4c532077b700253bb2c2c4e43523bb3031ee1226dfaa50401648aa18c79

SHA512
e6deb043d18a46b6de32e2cee0cedeffb5a7014dd46d406d6709e766558a8236597962398b811340a4a8816adcdf0ed72705eccdcd83fabe6ecaad64850fb7a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21715.exe

Filesize
468KB

MD5
35a5436995067112eb05b38935a0dcb5

SHA1
1f889fb1ed36c323715284d75ba5cabd573e98c4

SHA256
9ee9df58bcb75a9c55ab613b2d684d4d16633ad14689cd4887a05fff313f4366

SHA512
c0e994953577f277da8d596c2234e6b8b236c2081afceb3468cabbb66f48ae769a66e4970f2e434567d192a113fa6d6c86c1d271ceda287ea454e7b226777601

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe

Filesize
468KB

MD5
6e27ebd7c94716c81279770a3b038c96

SHA1
b9097e9b93a8ff1c0f908eb3896a21599d761e29

SHA256
59b753a577a7b9a1035d9c4860d56b78355a7fd8e9a3f7423825ce29675cab48

SHA512
c455debab083c883863a399c4c0ecd2d816eac70fe624d2f195bad23f3f6d0b2902b26df7dcdd6194124add77fbef8e13b370d446cfabf44d54345b2e719c8e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe

Filesize
468KB

MD5
258aefb461dda75558638d7289a795fa

SHA1
a7350d57775e226790d6217a04256f6d93c48fe8

SHA256
76e19a4e9a8b886d99e54ae1f17348d1fcd8f6280404bcd83c8c4562a1f8414b

SHA512
1a3ac668b8ce6ff74377c01a5f64d09d0becc58ccd7b62c275635d4a998f4ff463ef13e3e0f91e4d293a705365eb41cdeef0af2b6ed73cc195e80195ad3dc2ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26313.exe

Filesize
468KB

MD5
b8253cfe64e086aed3e6016a75a6cc39

SHA1
6e4f92889f3abf024b101a10432c3868b04a8e54

SHA256
2dd5fbd3905d7d9efee05febf9b11f83368f880b95bf3cc180aa4bdba848b939

SHA512
60e86b03a1bed355536b9b3ab8bb5922dfcbd73c9f44bd00c4a4321eef0ff34b52aa65b890b167460d0bba75faff323e6d60294ffaeebc15a535819a29283241

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe

Filesize
468KB

MD5
6a711da7aba1d5f2f6a97c44dcdc0a31

SHA1
6310823c044a40727e1c703a3b69cb8dcca3118a

SHA256
1c7bf677772f4b01d3cbbe6e3e801a9fbeec8cd7ca5375eb6d1e3bb999bec9d0

SHA512
bd0b9d1244833de494f64e2b81bd0ac42f70873328346fc457373826e1d0a0fb54da9be7b97a451572f3b385224968cc5c93663cb223ac5c9618d319ef14d7e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe

Filesize
468KB

MD5
725d1926611aa9c546d5871f00de723f

SHA1
658881b3e14aec994b1ebea8adf723c7808ea4bf

SHA256
58d320632833e0d96fff9fd42445aa6c107838dabb0f2bb15ae3c0e165bbbbb8

SHA512
961716220832e8e5e24da855c6bc97c158de9da139e6936d2ad7912f5420559c131c12f179ad8ad9617259ef890ec739386fb5a9634461e7888d3da2ebdabc1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30153.exe

Filesize
468KB

MD5
c829c383ef3024d58974f302f174d165

SHA1
1351df147f6f7dca9d8c5e4bd69a48644553a54a

SHA256
dc493e2c7e67d3c634d952fa07061832289403884eab0b20200e3812eb697d71

SHA512
78cd98730a72eb4d1fae8696b398abdd4820bd84ca2219a64107c5fce868504487ba5c41ec75b5a225a4b9cb42287878e0cc5806fbd9b02334157c31d705a53e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33012.exe

Filesize
468KB

MD5
9c8851fe1aa4f3fc8a6227cc2aaa7a76

SHA1
c398e0ba67ca5120e25e23aa8028ee91ee0690d7

SHA256
662771310b8f04b3a769a1839081f61c5fc36588338f96dccb2d539a1a773bcd

SHA512
654b962371afd8dc06fbd73b62b4c7aea7eb02ac84a2b81b5364365c072a246e4ab7313a55642ddd01ee7922521f176016d68f1bc8e1dd7c0bbea1154c6f3299

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe

Filesize
468KB

MD5
09e7ee5b3a90c5ce7a7e6fbac1a87df1

SHA1
dda616974fe3773c607661fff620a925b5410802

SHA256
b7937fe9db02b367bf93e68c59bc4225431a98fe10ed641cc14b83c58bf679fa

SHA512
e1ed96a9e9708f82814321da451f259e7ca91841d0ea19671ff96c2940e107985f634241fc6a3a28c18d0db051377eddeeeec248b3714111754db9b182faa41f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe

Filesize
468KB

MD5
6a109cb83d96bfbec6359aa50e5cd316

SHA1
b4136a96a7fccd9b7bc266aa37bd29f5816ce311

SHA256
e79f56748956e963ca82e251cf94b7e0b65113afea1e8c2bf4876b0e88734c7c

SHA512
bf994d3d88a19719ffa878af6c8a9f586995c18dad3ef43c2aeca2827526e4609eba7f77152c1dec4c3aacea7d2b4f4f4ba4c825c69a65870ac767ef90a06497

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34875.exe

Filesize
468KB

MD5
a2d8f959ba4e40d25cc02cbc8bbf5cbf

SHA1
f2e31f023bd1072e948005c28fc02f71bece3523

SHA256
0a684693a01ddcf150e48f8e3fe4599ab8ce535de3c6c93cf20af5c2fda9ffe1

SHA512
efaff82cb32520e4e49390d0ee830ecacca59f950bf71772bd4e53632f58da8ffb1d03bed9cc0dc65f00036001c1e2b8e60c3e979381b1849cea66b96823a481

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe

Filesize
468KB

MD5
3d35dc7f83690cb2a7e72221df88b172

SHA1
32858fae342396755e5a8ec95bcd6240151f2b9a

SHA256
aa7b3da94254e66517140499b1a29ed023d2b8c073cf7e4bc1a3c792a0797155

SHA512
ccd1dde1b65ebb0238589f279c4c15a2b8da4448bab721d6aa7f28c242b47690a21a82c554e73d18bf79a0358f82962d67347222923f84ccbcedc01fe7d14169

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe

Filesize
468KB

MD5
ebdfefb4b85c3e7eca354961269cf6f6

SHA1
23f3abc97262b13c038336a5e4633847762344d7

SHA256
4ed51db8d0d705d875091c1e46be2561dd0807785dd8670373f9b565c8c3d821

SHA512
5e572b823f465a38b82af207a20ad527fbd38d4f3f3c0f4d7bbe0f67ed8f999a1bc4be679b10529885839a5903129e703e5d921117c19b97fcf1f24386b32a55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe

Filesize
468KB

MD5
94c021b6500dfea7281e817b704d1a33

SHA1
be50df6eeb09289d403bea6a4b1b15b959988299

SHA256
8fa7cdba9d3d895efc148e3f0fd25c2e0a7371bcf71eb1f7dd1214a4d1f7105d

SHA512
36ee46402daef631d06a2c26c33e3314e4f18cdc99e558404d76c54f8df8c2c748157ccfabb6a369ef902c2b5397f4912a746aa3ee413609c71525176eb4f8f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45913.exe

Filesize
468KB

MD5
cc10a6f0ce8e186992976d3356278a03

SHA1
b7cd6b73e3a3d20bfb60db087a83676f3aeefb5f

SHA256
5db35afe5f367b7b9df71c05cd023eefe292ab554a89c644579ca650535c8b52

SHA512
2d1f41845eab2b2903455150b2f12c61c3cec2043b10448b791cd1729f49de66ec5d8782af93ee80f8ef7cd454833178812bda71b8efb4782136e8c6287e0c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49530.exe

Filesize
468KB

MD5
fed9b0d743f66c5f4e7b6df61f0fe93d

SHA1
7e6270d40d9103c3549427a9e4857f9c64edc692

SHA256
468029ddcbcfb7fb773f0dfa040d96ffd3de979ea0fa182d7bf48d774850c3da

SHA512
7e6092bd1ba500501df64abb9801438a04b51d4464f056236381310d958e1cdc0a16f2c60bb7bf02829c2ba384442abe43be098f0a6a5f92ae4e637674bf6c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe

Filesize
468KB

MD5
cfda014dddcbe61ac206ddd8b9f31685

SHA1
a7d15a493cfc5946fecadd0a190525e175975e4a

SHA256
53b5d5bd0c16f6d6937cefe54d5a1ec3f4d4801ae0b701eeb3eab5fbb9ad9180

SHA512
26885267636d2ae7ac843fa55d8935c082664c82723b70973db6e34650bbb9bc045810ab1c08be26a0e2e26b6f7d0630b6f712cfe1fe8716b6553b03a493e5a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51066.exe

Filesize
468KB

MD5
f93a4fbdc08f7174ea05cf91f48ab61d

SHA1
e2c9bb5c91443ac2f7aa0e0b999685fccc357284

SHA256
d7e896641b59d981f1f2fb233bc74455f3e4dd379154389600cfc05829a1dded

SHA512
e17068b134e1cbe0a9d8bb2689a0312719815b729007f4ee7698c5972f8b9980f577ab117c4ffa6014e61b58a25ea46ec61ae82c77427e007ad6abd3aab561b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe

Filesize
468KB

MD5
bec79ab56033683c80e144f0e75ed71a

SHA1
ce655daa2645fbc23054b63be891eeaa7749cbdd

SHA256
d4b9b03d5035798d8cf245c744847375b47752932d1b7ff01b2f6ac10d4c1fc7

SHA512
02d8c34104c5d64ae14cd2024c925d32535cb37aba184aa62a5c68334cc9fc27b495d59a999fc289dfacfe25afd85966f5216e91f72a04591307471697ac62c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56119.exe

Filesize
468KB

MD5
c9477f04b576fd4902964a8b7dbce3fa

SHA1
1614457f9936bc3a49efe1f56ddab044193c4647

SHA256
717b0c80c3e0e9aaa22e00a3c458a07e71e2a84682a264d0cba07c750deabcba

SHA512
2374e635e41eced30067bd698ff5607160c59e05cb827494da6742cb5bb23ef0ccd5c5aecef78a90f74e374d02c83894d68fb015cf15ac3e7e7ea59402636f15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56219.exe

Filesize
468KB

MD5
8a2bdfe81b487efedc609704744f2cec

SHA1
b8e7af50a754087c76ceaef5be702724ed5be080

SHA256
c8c13b95ffd47c5ca06dd49b39b3af6bca220c1b07a7b6321180b2b59ae0bea0

SHA512
4a9acf82cda47ed2a8a84a98ec52503b1a956ca26b5198c1c05f5ffc09a6999330dca0ef964c388be7def3dd53319bb7b2b627adc3a5f7f78e1fb06d951b378b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe

Filesize
468KB

MD5
7c81e828696245d214cccdb3318603e3

SHA1
116c08522005cfd21f671d15a5dc99913920a68e

SHA256
b00e40787d6b637d717371506b9412249adc376b8325cb8e4ac7b911a7579067

SHA512
7447d7151a41f309956ca080cc6992e44f138ffcd6d4b7f67c6cc24dc1d86ff26603916febc07e26814ec368917820b48addc55691154e9cfc1c07805648af49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61543.exe

Filesize
468KB

MD5
19a552afc311c820985ada8ec7f653f5

SHA1
f15d16175a6ca1e4e5cf564d65a599c0e12d5467

SHA256
1c15ce98fb791915ad2f9b4479ccf05165c00f70d6f8dfb8ed2c7baa2d85f5c4

SHA512
d662cd4793191883f2d62543988f329fbad505820dac0d026e29573dd08f78e4ee9cde5253d54992ad73eea6c598b6fc457c279ed1856602f383fb1910bb22c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62192.exe

Filesize
468KB

MD5
a754d221a1c1d2f9a95d9eb7131c3f26

SHA1
78aecd2baf8df91676b37f97c2ae83d173475ce8

SHA256
d48ccda2f99fef0e6748e4ccc34be3030a1fd8547474fd5e0dccc22cb3aec96d

SHA512
df8c64eadbe46762395a972465dfde074563a6aca87a65967563da88825cfd339d3c2ab565f9719e7f2a9ff3db2dfd3e2b25bc116d264c8a14a523a6be56e9e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe

Filesize
468KB

MD5
1149f46e06ef608ccd07d6b33bd86d18

SHA1
23e3ea78507a288776cb1b218bc5f9a3c82e3d7f

SHA256
57daaf11f1fd73be11e653bb66fbf633f2d21eecc6a9d340df883794785a803c

SHA512
71e969dbb7f678c46652fa5bf886ef42bde53b59904997df588671e08da341ee930003298e9011bea5021629a80fd59b97e9faaf468303918d4017755dd119c4

Download Submit
memory/60-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/116-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/212-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/376-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/624-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/628-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/696-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/764-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/808-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/812-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/940-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1040-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1072-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1136-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1204-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1240-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1324-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1336-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1396-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1428-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1440-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1464-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1476-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1808-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1880-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2156-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2272-30-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2720-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3256-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3416-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3464-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3516-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3524-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3536-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3556-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3664-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3712-149-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3732-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3764-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3972-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4128-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4152-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4156-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4256-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4336-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4448-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4456-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4644-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4792-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4996-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5060-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5180-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads