903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81

Analysis

max time kernel
120s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe
Size

468KB
MD5

84f2e9e802e390aedfff1468ebb15930
SHA1

e1640a1e5e2c2694180f56873e60a0c40f89f512
SHA256

903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81
SHA512

1b5dabd2c65bfe58fece63f3fbc26ca35269b2a44fcf67058b8a853ab173a889ef31c11d733dd138dbab05becd5275100ed87aafcaaae18c797c5384a7159458
SSDEEP

3072:t+7OogxdWJ8U1bYTPzijfx8/9ChjAWpSsdHeeVwqGf/3n5qN7nlG:t+ConaU1APejfxu2qiGf/5qN7

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4452	Unicorn-5211.exe
3560	Unicorn-41452.exe
2076	Unicorn-21394.exe
2228	Unicorn-44348.exe
2172	Unicorn-24290.exe
2988	Unicorn-44156.exe
3056	Unicorn-5353.exe
1100	Unicorn-23596.exe
1804	Unicorn-52931.exe
4160	Unicorn-58271.exe
1780	Unicorn-52826.exe
1668	Unicorn-9298.exe
3252	Unicorn-9563.exe
3616	Unicorn-9563.exe
3484	Unicorn-55235.exe
4896	Unicorn-61660.exe
3220	Unicorn-8546.exe
1344	Unicorn-60508.exe
2672	Unicorn-40538.exe
2296	Unicorn-13803.exe
2744	Unicorn-9890.exe
3476	Unicorn-13419.exe
4688	Unicorn-44831.exe
2896	Unicorn-44831.exe
3880	Unicorn-44831.exe
3568	Unicorn-38701.exe
2012	Unicorn-53114.exe
3792	Unicorn-42178.exe
2260	Unicorn-35843.exe
2472	Unicorn-12843.exe
4532	Unicorn-44367.exe
428	Unicorn-24309.exe
4560	Unicorn-43983.exe
4252	Unicorn-9129.exe
532	Unicorn-55917.exe
3992	Unicorn-15727.exe
4216	Unicorn-14574.exe
4616	Unicorn-61315.exe
1340	Unicorn-47055.exe
2704	Unicorn-17263.exe
4276	Unicorn-48975.exe
2840	Unicorn-26124.exe
2764	Unicorn-12389.exe
1420	Unicorn-38991.exe
1988	Unicorn-6318.exe
2240	Unicorn-6318.exe
3216	Unicorn-39183.exe
2844	Unicorn-38918.exe
1020	Unicorn-29292.exe
536	Unicorn-38223.exe
5068	Unicorn-18357.exe
4424	Unicorn-18357.exe
3584	Unicorn-51222.exe
4268	Unicorn-5550.exe
1252	Unicorn-21695.exe
3624	Unicorn-45429.exe
1728	Unicorn-297.exe
3796	Unicorn-17973.exe
1416	Unicorn-21237.exe
3472	Unicorn-43599.exe
4336	Unicorn-56214.exe
1656	Unicorn-59359.exe
632	Unicorn-9966.exe
4588	Unicorn-9509.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
13828	14724	WerFault.exe	729
2236	14856	WerFault.exe	706
2248	14680	WerFault.exe	775

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56429.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4668	dwm.exe
Token: SeChangeNotifyPrivilege	4668	dwm.exe
Token: 33	4668	dwm.exe
Token: SeIncBasePriorityPrivilege	4668	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe
4452	Unicorn-5211.exe
3560	Unicorn-41452.exe
2076	Unicorn-21394.exe
2228	Unicorn-44348.exe
2172	Unicorn-24290.exe
2988	Unicorn-44156.exe
3056	Unicorn-5353.exe
1100	Unicorn-23596.exe
4160	Unicorn-58271.exe
1804	Unicorn-52931.exe
3484	Unicorn-55235.exe
3252	Unicorn-9563.exe
3616	Unicorn-9563.exe
1780	Unicorn-52826.exe
1668	Unicorn-9298.exe
4896	Unicorn-61660.exe
3220	Unicorn-8546.exe
1344	Unicorn-60508.exe
2672	Unicorn-40538.exe
2296	Unicorn-13803.exe
2744	Unicorn-9890.exe
3476	Unicorn-13419.exe
2472	Unicorn-12843.exe
3792	Unicorn-42178.exe
2896	Unicorn-44831.exe
2260	Unicorn-35843.exe
4688	Unicorn-44831.exe
2012	Unicorn-53114.exe
3880	Unicorn-44831.exe
3568	Unicorn-38701.exe
4532	Unicorn-44367.exe
428	Unicorn-24309.exe
4252	Unicorn-9129.exe
4560	Unicorn-43983.exe
3992	Unicorn-15727.exe
532	Unicorn-55917.exe
4216	Unicorn-14574.exe
4616	Unicorn-61315.exe
1340	Unicorn-47055.exe
2704	Unicorn-17263.exe
4276	Unicorn-48975.exe
2240	Unicorn-6318.exe
1420	Unicorn-38991.exe
2844	Unicorn-38918.exe
2840	Unicorn-26124.exe
1988	Unicorn-6318.exe
2764	Unicorn-12389.exe
3216	Unicorn-39183.exe
1020	Unicorn-29292.exe
536	Unicorn-38223.exe
3796	Unicorn-17973.exe
3584	Unicorn-51222.exe
5068	Unicorn-18357.exe
3624	Unicorn-45429.exe
4268	Unicorn-5550.exe
1416	Unicorn-21237.exe
4424	Unicorn-18357.exe
1252	Unicorn-21695.exe
1728	Unicorn-297.exe
3472	Unicorn-43599.exe
4588	Unicorn-9509.exe
2976	Unicorn-58975.exe
4336	Unicorn-56214.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 4452	224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe	82
PID 224 wrote to memory of 4452	224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe	82
PID 224 wrote to memory of 4452	224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe	82
PID 4452 wrote to memory of 3560	4452	Unicorn-5211.exe	83
PID 4452 wrote to memory of 3560	4452	Unicorn-5211.exe	83
PID 4452 wrote to memory of 3560	4452	Unicorn-5211.exe	83
PID 224 wrote to memory of 2076	224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe	84
PID 224 wrote to memory of 2076	224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe	84
PID 224 wrote to memory of 2076	224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe	84
PID 3560 wrote to memory of 2228	3560	Unicorn-41452.exe	89
PID 3560 wrote to memory of 2228	3560	Unicorn-41452.exe	89
PID 3560 wrote to memory of 2228	3560	Unicorn-41452.exe	89
PID 4452 wrote to memory of 2172	4452	Unicorn-5211.exe	90
PID 4452 wrote to memory of 2172	4452	Unicorn-5211.exe	90
PID 4452 wrote to memory of 2172	4452	Unicorn-5211.exe	90
PID 2076 wrote to memory of 2988	2076	Unicorn-21394.exe	91
PID 2076 wrote to memory of 2988	2076	Unicorn-21394.exe	91
PID 2076 wrote to memory of 2988	2076	Unicorn-21394.exe	91
PID 224 wrote to memory of 3056	224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe	92
PID 224 wrote to memory of 3056	224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe	92
PID 224 wrote to memory of 3056	224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe	92
PID 2228 wrote to memory of 1100	2228	Unicorn-44348.exe	94
PID 2228 wrote to memory of 1100	2228	Unicorn-44348.exe	94
PID 2228 wrote to memory of 1100	2228	Unicorn-44348.exe	94
PID 3560 wrote to memory of 1804	3560	Unicorn-41452.exe	95
PID 3560 wrote to memory of 1804	3560	Unicorn-41452.exe	95
PID 3560 wrote to memory of 1804	3560	Unicorn-41452.exe	95
PID 2172 wrote to memory of 4160	2172	Unicorn-24290.exe	96
PID 2172 wrote to memory of 4160	2172	Unicorn-24290.exe	96
PID 2172 wrote to memory of 4160	2172	Unicorn-24290.exe	96
PID 4452 wrote to memory of 1780	4452	Unicorn-5211.exe	97
PID 4452 wrote to memory of 1780	4452	Unicorn-5211.exe	97
PID 4452 wrote to memory of 1780	4452	Unicorn-5211.exe	97
PID 224 wrote to memory of 1668	224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe	98
PID 224 wrote to memory of 1668	224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe	98
PID 224 wrote to memory of 1668	224	903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe	98
PID 3056 wrote to memory of 3252	3056	Unicorn-5353.exe	99
PID 3056 wrote to memory of 3252	3056	Unicorn-5353.exe	99
PID 3056 wrote to memory of 3252	3056	Unicorn-5353.exe	99
PID 2988 wrote to memory of 3616	2988	Unicorn-44156.exe	100
PID 2988 wrote to memory of 3616	2988	Unicorn-44156.exe	100
PID 2988 wrote to memory of 3616	2988	Unicorn-44156.exe	100
PID 2076 wrote to memory of 3484	2076	Unicorn-21394.exe	101
PID 2076 wrote to memory of 3484	2076	Unicorn-21394.exe	101
PID 2076 wrote to memory of 3484	2076	Unicorn-21394.exe	101
PID 1100 wrote to memory of 4896	1100	Unicorn-23596.exe	104
PID 1100 wrote to memory of 4896	1100	Unicorn-23596.exe	104
PID 1100 wrote to memory of 4896	1100	Unicorn-23596.exe	104
PID 2228 wrote to memory of 3220	2228	Unicorn-44348.exe	105
PID 2228 wrote to memory of 3220	2228	Unicorn-44348.exe	105
PID 2228 wrote to memory of 3220	2228	Unicorn-44348.exe	105
PID 1804 wrote to memory of 1344	1804	Unicorn-52931.exe	106
PID 1804 wrote to memory of 1344	1804	Unicorn-52931.exe	106
PID 1804 wrote to memory of 1344	1804	Unicorn-52931.exe	106
PID 3560 wrote to memory of 2672	3560	Unicorn-41452.exe	107
PID 3560 wrote to memory of 2672	3560	Unicorn-41452.exe	107
PID 3560 wrote to memory of 2672	3560	Unicorn-41452.exe	107
PID 4160 wrote to memory of 2296	4160	Unicorn-58271.exe	108
PID 4160 wrote to memory of 2296	4160	Unicorn-58271.exe	108
PID 4160 wrote to memory of 2296	4160	Unicorn-58271.exe	108
PID 2172 wrote to memory of 2744	2172	Unicorn-24290.exe	109
PID 2172 wrote to memory of 2744	2172	Unicorn-24290.exe	109
PID 2172 wrote to memory of 2744	2172	Unicorn-24290.exe	109
PID 3484 wrote to memory of 3476	3484	Unicorn-55235.exe	110

C:\Users\Admin\AppData\Local\Temp\903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe
"C:\Users\Admin\AppData\Local\Temp\903ed601fd093d2cbbfb73056e724e886d289fc002cf68c4cb318cf2b1e95a81N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe
        10⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31151.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        11⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
        10⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe
        10⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51374.exe
        10⤵
        
        PID:15516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56742.exe
        9⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
        10⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        10⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50358.exe
        9⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14156.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20501.exe
        9⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60544.exe
        9⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
        8⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        9⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        9⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59930.exe
        9⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40717.exe
        8⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
        8⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2828.exe
        8⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56214.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3646.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe
        9⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17455.exe
        10⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4973.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54854.exe
        9⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56429.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        9⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe
        8⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        9⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        9⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe
        8⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20373.exe
        8⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe
        8⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34495.exe
        9⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59366.exe
        9⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        9⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        8⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15692.exe
        8⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
        8⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40349.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23365.exe
        7⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        7⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59359.exe
        7⤵
        Executes dropped EXE
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        8⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
        9⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        10⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24869.exe
        9⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12604.exe
        9⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        9⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35029.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        8⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
        8⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe
        8⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39599.exe
        8⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49839.exe
        9⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        9⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        9⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        8⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43511.exe
        8⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        8⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        8⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
        8⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18725.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
        7⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
        7⤵
        
        PID:16168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3644.exe
        6⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21327.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46934.exe
        8⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        7⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        7⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        7⤵
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48127.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59246.exe
        7⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46823.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43983.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
        9⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
        10⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        10⤵
        
        PID:17000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
        9⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44317.exe
        9⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        9⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60582.exe
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        9⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe
        8⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40861.exe
        8⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21269.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        8⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe
        8⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        8⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18509.exe
        8⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe
        7⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25180.exe
        7⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32688.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe
        6⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21903.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        8⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe
        8⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        8⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        7⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        7⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        7⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12700.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3918.exe
        7⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1222.exe
        7⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21900.exe
        6⤵
        
        PID:12252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6341.exe
        6⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9129.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        6⤵
        Executes dropped EXE
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
        8⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61037.exe
        8⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59246.exe
        8⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60751.exe
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39094.exe
        8⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        7⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        7⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40439.exe
        7⤵
        
        PID:17332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14053.exe
        6⤵
        
        PID:13124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13967.exe
        6⤵
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
        8⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exe
        8⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4294.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31436.exe
        7⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
        7⤵
        
        PID:17048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56934.exe
        6⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54335.exe
        7⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38453.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        7⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        6⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        5⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
        6⤵
        
        PID:16428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29445.exe
        5⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        5⤵
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
        5⤵
        
        PID:15832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52931.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60508.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65135.exe
        7⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55535.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37103.exe
        9⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
        9⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
        9⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        9⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
        8⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        8⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44422.exe
        8⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        8⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37413.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
        8⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        8⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56669.exe
        7⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
        7⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        7⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45078.exe
        6⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        8⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60669.exe
        8⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13437.exe
        8⤵
        
        PID:16936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32453.exe
        8⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe
        7⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe
        7⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42710.exe
        7⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56831.exe
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe
        7⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        7⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        7⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46582.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61693.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
        6⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        8⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        8⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26381.exe
        8⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe
        7⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64493.exe
        7⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13967.exe
        7⤵
        
        PID:17132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50602.exe
        6⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33895.exe
        7⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        6⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe
        5⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        6⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        7⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        7⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10838.exe
        7⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
        6⤵
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        6⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
        6⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        6⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        6⤵
        
        PID:16928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58399.exe
        5⤵
        
        PID:12724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
        5⤵
        
        PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40538.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48975.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe
        6⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
        8⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        8⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59776.exe
        8⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43149.exe
        7⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
        7⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1806.exe
        7⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        7⤵
        
        PID:17056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61318.exe
        6⤵
        
        PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
        5⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe
        6⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6658.exe
        7⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        7⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32910.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        5⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55133.exe
        5⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61894.exe
        5⤵
        
        PID:14580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe
        5⤵
        
        PID:15276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25935.exe
        5⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        7⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        7⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60999.exe
        7⤵
        
        PID:16160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        6⤵
        
        PID:11024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56422.exe
        6⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33102.exe
        6⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19458.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        6⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        5⤵
        
        PID:13284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51456.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
      4⤵
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        5⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        6⤵
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38389.exe
        6⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6229.exe
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        5⤵
        
        PID:17024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
      4⤵
      PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42710.exe
        5⤵
        
        PID:14516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe
      4⤵
      PID:10128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36868.exe
      4⤵
      PID:14060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6206.exe
      4⤵
      PID:720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24290.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58271.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13803.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33807.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64575.exe
        8⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        9⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27324.exe
        9⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        9⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50998.exe
        8⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        8⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe
        8⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exe
        8⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        8⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        8⤵
        
        PID:17252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe
        7⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        7⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        6⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49471.exe
        8⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        8⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        8⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42933.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        7⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        7⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        7⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47117.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exe
        7⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61574.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40173.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        6⤵
        
        PID:15936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24799.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52975.exe
        8⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        8⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63920.exe
        8⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1989.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        7⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32150.exe
        7⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9541.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25711.exe
        7⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26357.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        7⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30249.exe
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26259.exe
        6⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40381.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14542.exe
        6⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
        6⤵
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        5⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-764.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11157.exe
        5⤵
        
        PID:15468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17263.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        6⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        8⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39781.exe
        8⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59997.exe
        8⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        8⤵
        
        PID:17264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        7⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        6⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50111.exe
        7⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        7⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        7⤵
        
        PID:17124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7509.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe
        6⤵
        
        PID:14680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14680 -s 80
        7⤵
        Program crash
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56038.exe
        5⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29791.exe
        6⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13865.exe
        7⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16781.exe
        7⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-246.exe
        6⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51149.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34479.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15238.exe
        6⤵
        
        PID:17148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14521.exe
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47861.exe
        5⤵
        
        PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62271.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58879.exe
        7⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31574.exe
        7⤵
        
        PID:17096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16514.exe
        6⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        6⤵
        
        PID:12936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48640.exe
        6⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        6⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22461.exe
        6⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe
        5⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        5⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
        5⤵
        
        PID:15596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe
      4⤵
      PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
      4⤵
      PID:11408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50206.exe
      4⤵
      PID:7328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        6⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64959.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        8⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
        8⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        8⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        7⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe
        7⤵
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
        7⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59718.exe
        7⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37262.exe
        7⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50141.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        6⤵
        
        PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
        5⤵
        
        PID:232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
        6⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14997.exe
        7⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11689.exe
        7⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        7⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37541.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33494.exe
        6⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55181.exe
        5⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16431.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe
        6⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39670.exe
        5⤵
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38060.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        5⤵
        
        PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13950.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        7⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        6⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        5⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
        5⤵
        
        PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
      4⤵
      PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31071.exe
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        5⤵
        
        PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
      4⤵
      PID:7956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49965.exe
      4⤵
      PID:12268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35843.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        5⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46127.exe
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        7⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        7⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        6⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        6⤵
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37413.exe
        5⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14942.exe
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17701.exe
        6⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe
        6⤵
        
        PID:17228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19196.exe
        5⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57727.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25381.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
      4⤵
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12302.exe
        5⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe
        6⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
        6⤵
        
        PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        5⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1782.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
      4⤵
      PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18159.exe
        5⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
        5⤵
        
        PID:16032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17189.exe
      4⤵
      PID:10000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53245.exe
      4⤵
      PID:12752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
      4⤵
      PID:3564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29292.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61679.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55134.exe
        6⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        5⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57518.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52406.exe
      4⤵
      PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9870.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14466.exe
        5⤵
        
        PID:14724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14724 -s 280
        6⤵
        Program crash
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13437.exe
        5⤵
        
        PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55709.exe
      4⤵
      PID:9544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
      4⤵
      PID:13612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe
      4⤵
      PID:15812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21045.exe
    3⤵
    PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49455.exe
      4⤵
      PID:11052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
      4⤵
      PID:14800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
      4⤵
      PID:4368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13838.exe
    3⤵
    PID:7356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45300.exe
    3⤵
    PID:10828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31871.exe
    3⤵
    PID:15872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21394.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21394.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44156.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
        8⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        9⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        9⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        9⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
        8⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
        8⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58561.exe
        8⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        7⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        7⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52179.exe
        7⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53926.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32924.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        7⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15238.exe
        7⤵
        
        PID:17140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30140.exe
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58630.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11535.exe
        6⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17973.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63759.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        8⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26381.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5269.exe
        7⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61037.exe
        7⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        7⤵
        
        PID:17180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7826.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        6⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31823.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        6⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        6⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43094.exe
        5⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3566.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24871.exe
        6⤵
        
        PID:16888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46901.exe
        5⤵
        
        PID:14856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14856 -s 464
        6⤵
        Program crash
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
        5⤵
        
        PID:15588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
        5⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        6⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26983.exe
        8⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31221.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51053.exe
        7⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        7⤵
        
        PID:17192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21573.exe
        6⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        7⤵
        
        PID:16040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41597.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        6⤵
        
        PID:14628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        6⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        5⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe
        5⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57869.exe
        5⤵
        
        PID:14024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15622.exe
        5⤵
        
        PID:16736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15285.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64575.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        6⤵
        
        PID:12084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        6⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45325.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        5⤵
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe
        5⤵
        
        PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
      4⤵
      PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19829.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
        5⤵
        
        PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
      4⤵
      PID:8184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21678.exe
      4⤵
      PID:13148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22350.exe
      4⤵
      PID:15908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55235.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47055.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
        6⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        7⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe
        8⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51910.exe
        8⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20393.exe
        7⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
        7⤵
        
        PID:16444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56934.exe
        6⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        7⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42710.exe
        6⤵
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        5⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15374.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        7⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        7⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13564.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        6⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47487.exe
        6⤵
        
        PID:13156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16287.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        5⤵
        
        PID:10168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe
        5⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        5⤵
        
        PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10764.exe
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15566.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57775.exe
        6⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
        7⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        7⤵
        
        PID:17244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43814.exe
        6⤵
        
        PID:10816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        6⤵
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
        5⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
        5⤵
        
        PID:10864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61046.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16095.exe
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        5⤵
        
        PID:12356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        5⤵
        
        PID:17016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15820.exe
      4⤵
      PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
      4⤵
      PID:13036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38223.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        6⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1222.exe
        7⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-85.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60669.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
        5⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47679.exe
        6⤵
        
        PID:12980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35446.exe
        6⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7826.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43478.exe
        5⤵
        
        PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
        5⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        5⤵
        
        PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48781.exe
      4⤵
      PID:8044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58438.exe
      4⤵
      PID:10736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12302.exe
        5⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
        6⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44174.exe
        6⤵
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4994.exe
        5⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40861.exe
        5⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59046.exe
      4⤵
      PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
      4⤵
      PID:10012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34461.exe
      4⤵
      PID:14936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
    3⤵
    PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63919.exe
      4⤵
      PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
      4⤵
      PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe
      4⤵
      PID:6844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58070.exe
    3⤵
    PID:5404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
    3⤵
    PID:11236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
    3⤵
    PID:15136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56366.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6318.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        6⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        8⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe
        8⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        7⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        7⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55406.exe
        7⤵
        
        PID:15916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        6⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57807.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
        7⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        7⤵
        
        PID:17032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27478.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe
        6⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
        6⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5198.exe
        6⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exe
        7⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        7⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        7⤵
        
        PID:17236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
        6⤵
        
        PID:13184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        5⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63491.exe
        6⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41207.exe
        6⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39478.exe
        5⤵
        
        PID:9832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7797.exe
        5⤵
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe
        5⤵
        
        PID:15104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55982.exe
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
        5⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15839.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        7⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        7⤵
        
        PID:16148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3733.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        6⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43394.exe
        5⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
        6⤵
        
        PID:13180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
        5⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57197.exe
        5⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38245.exe
        5⤵
        
        PID:15156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
      4⤵
      PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18351.exe
        6⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        6⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14693.exe
        5⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe
      4⤵
      PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        5⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38518.exe
        5⤵
        
        PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38797.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12693.exe
      4⤵
      PID:14560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
      4⤵
      PID:6204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5550.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
        7⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
        7⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47558.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61037.exe
        6⤵
        
        PID:14148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62400.exe
        6⤵
        
        PID:17272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56742.exe
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1157.exe
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
        5⤵
        
        PID:14556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        5⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
      4⤵
      PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        5⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52559.exe
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        6⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4226.exe
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60669.exe
        5⤵
        
        PID:12776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
      4⤵
      PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43135.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40823.exe
        5⤵
        
        PID:15880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
      4⤵
      PID:11140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29612.exe
      4⤵
      PID:14952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33686.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-297.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
        5⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7598.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
        6⤵
        
        PID:15896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34293.exe
        5⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-325.exe
        5⤵
        
        PID:14460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        5⤵
        
        PID:15676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe
      4⤵
      PID:11352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
      4⤵
      PID:16992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
    3⤵
    PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
      4⤵
      PID:12404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
      4⤵
      PID:13992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
      4⤵
      PID:15428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51174.exe
    3⤵
    PID:9372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10443.exe
    3⤵
    PID:13048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5822.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6318.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19967.exe
        5⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64383.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33135.exe
        7⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        7⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        7⤵
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        6⤵
        
        PID:412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        5⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54527.exe
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe
        6⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
        6⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
        5⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65165.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57973.exe
        5⤵
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
      4⤵
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42479.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50758.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
        6⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        5⤵
        
        PID:12316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        5⤵
        
        PID:14864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-412.exe
      4⤵
      PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18143.exe
        5⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        5⤵
        
        PID:14488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
        5⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        5⤵
        
        PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38714.exe
      4⤵
      PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
      4⤵
      PID:13504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
      4⤵
      PID:15088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe
      4⤵
      PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44422.exe
      4⤵
      PID:15496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51222.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
      4⤵
      PID:796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        6⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4885.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1644.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        5⤵
        
        PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7733.exe
      4⤵
      PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16607.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        5⤵
        
        PID:14736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        5⤵
        
        PID:16476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
      4⤵
      PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
      4⤵
      PID:14016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65207.exe
      4⤵
      PID:16004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
    3⤵
    PID:992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
      4⤵
      PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5250.exe
        5⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        5⤵
        
        PID:16484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6229.exe
      4⤵
      PID:8236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40093.exe
      4⤵
      PID:13212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
      4⤵
      PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
    3⤵
    PID:7188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
    3⤵
    PID:8908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe
    3⤵
    PID:13332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
    3⤵
    PID:15796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64486.exe
    3⤵
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64959.exe
      4⤵
      PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        5⤵
        
        PID:12484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        5⤵
        
        PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
      4⤵
      PID:10232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52966.exe
      4⤵
      PID:12880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe
      4⤵
      PID:6288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
    3⤵
    PID:8132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1230.exe
      4⤵
      PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49262.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23413.exe
    3⤵
    PID:11100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30143.exe
    3⤵
    PID:14964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
    3⤵
    PID:6044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45429.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45429.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
    3⤵
    PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
      4⤵
      PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59663.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33895.exe
        5⤵
        
        PID:15356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
      4⤵
      PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49990.exe
      4⤵
      PID:13324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18118.exe
      4⤵
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
    3⤵
    PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
      4⤵
      PID:14280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19005.exe
      4⤵
      PID:16880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4204.exe
    3⤵
    PID:9516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
    3⤵
    PID:13364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
    3⤵
    PID:3608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65007.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65007.exe
  2⤵
  PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65471.exe
    3⤵
    PID:8164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19221.exe
    3⤵
    PID:11188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe
    3⤵
    PID:14992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
    3⤵
    PID:4492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61301.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61301.exe
  2⤵
  PID:7876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45725.exe
  2⤵
  PID:11160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
  2⤵
  PID:14552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
  2⤵
  PID:2132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57479.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57479.exe
  2⤵
  PID:7508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 14856 -ip 14856
1⤵
PID:14484

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe

Filesize
468KB

MD5
dbc757212185a6733ca9a5563396be5b

SHA1
0f17980bc3b1b133eb5e2464817a732179e45347

SHA256
8271dba95f1dedbe17ba895ef0d8f9967299664541aa4af62a5cfc300d2a9d58

SHA512
ec6e184aa05c11feecad7fbc06058c771380c3b0b06e4d67f153fd802c1d3a308c43eec0091322f0558c4ea975830c3110c91c3a090c39d4344cc13146909097

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe

Filesize
468KB

MD5
c81510b3f64f12aa42cabae652ed48a6

SHA1
6a044583816ade900c6455a015fe680575b12e2e

SHA256
b41de31f94e1f2c1a53a710d077737c23f0b97381ec29125d2da74b2f164cd17

SHA512
b4ebc5273eceac2871c6c6e2b214c27c004776629e282e0893c7359c567dd9f80af728eeec38f105511481918eae4cc73f7d033b7776849a6ce9cfe6725d7e91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13803.exe

Filesize
468KB

MD5
0f23c16ad1f6a3867c50fd1f354a8903

SHA1
72c19cbaffffdf69811793a579272e65bb309b8e

SHA256
ce0cab5d255acedd70accef42dd24693db92edbf0191aa8700ec970971f5e2d5

SHA512
3118b718e055c8044e4caa4fcca513257476c50f2f0f8cc3c24014ba13d3625153e356915515ed99b57b80a1bc65e549cf37ef727b07681679b71c2f9575500e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21394.exe

Filesize
468KB

MD5
e3c6b8d57654530dec9d3597710e66c2

SHA1
b5f24dd0c93c009f61e0f543e01c9abe5de9dd01

SHA256
5950ab5ce2bf32ea71acccb8c0e1294bb93433a02bff11f683e21651c82a0358

SHA512
9dd81dfe6e0db8206ce1219ef307819c4b99c4f3d737ba74168b6ccdfe0d0dd8b050390cf221a3d8e88bb7ab0a33fc974e505b3698ce1708a5da8339fbbff070

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe

Filesize
468KB

MD5
9f247a1cbc42eb950888de2706d1e9dc

SHA1
13770569fe797b6752bdef62dd29b27dc23bcac0

SHA256
39db028a38fe745e39633f9e7b51fbed30ba8f63b235df009d7618208d684b33

SHA512
d0e949c4eedabff03f34d35bf69a461a8d66e0b532b1a59587ab3c91275d02ec30344d697b2132bef0b69fc37d4ff490974df5229b7b0bf1b55c64d64223b4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24290.exe

Filesize
468KB

MD5
9d32c30ad6a0dfa13eb295b619f0e245

SHA1
547633d253f743a50fd29ee83aaf68882081bb31

SHA256
46ab0cc82efe769737d2eff84b2e8622233a61aad06ac9d175e8be324cbdb2b6

SHA512
a9493712b0e6fb2f13cf7b7a5a73f42143dd6ffa09555c5fc0399b127756ccbb3499cd8b7d5f0d790b421bafae32264fddf6427dbd825138fc8882bd46fb645c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe

Filesize
468KB

MD5
7a9539eca538df000dec824602fa3824

SHA1
3a55a9005df0b615d2d09edda845ab6d9553de1b

SHA256
f7415e0e52515a3ac580f4697a2dd9a491c5177f3e80d983281a864506efc742

SHA512
5a57cf37760dddfbd0ee0c905c34e3b0e72e23f2f72a35848475b99da54c898210ebfd00dfc850c7772ad49a0681ac9d47a2615030f48841923dfddfafe96bfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35843.exe

Filesize
468KB

MD5
b2dd3c949993a9a5634493a3a20c2f31

SHA1
975da3c9d1eda969b0bedbad9644dc120de6f725

SHA256
78ebfe79d8600c23aabd08fcba9073bc1817c5b96af9b55b69f9849ae7f23cfd

SHA512
d419ec92c8197606c7631ec27bc22ef68a185d79dc4a497fb3badb08f273867dc94c090d0bb0e1d042f0570bd3ec580bef34342e973aa806f2dfb5aa34ed8b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe

Filesize
468KB

MD5
e73932825c4e2f80a7f9b7fe4e5a2fff

SHA1
74423cd683a22f09bb5624dd00f5d5952add98dc

SHA256
038c2a531f67fec8ff39f32991d41954862a74bdba091b010e6cb4799a9a476a

SHA512
4b38c27f0cc039a71c1cc2be46dd177a4aaddebe8ce4e5d5ca040db0d16ac7edc863eb7d8badbe901532b144f1d4e13c001e974464f2624e34db25701011a997

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40538.exe

Filesize
468KB

MD5
bfcd3663182ca249ea1cb09138e56e6e

SHA1
c791fc1b185d21f63e35eac43e9883035bf3832a

SHA256
87c7734638ed6c5135a7c2751e6fed3591e9a2dab8fd19d6f15a25082e9a708f

SHA512
c39b2e341fbe5ab87cd1db84d32162ae5816a3e51520b647b62111a51ade362799bc0d85608ded0ced56cbbbfbb55d01c75ba6d8e824486886dc83366008dcd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe

Filesize
468KB

MD5
7eaadb41e6f3bc9f632055192579b50f

SHA1
5e6473b83953af2ab497b9e7b6129f9f4603bfd5

SHA256
e2b08dfb03ab6e1508e053704cad1bc2aac77e449884c85d38d971651d240154

SHA512
8e83e01a4f5260284568ce620d72ca2755de8de8d1749502a8a81f2c28ef189edf364b2421fb5dc0d6be8cbba78bb7e97bc8697e7810b5167143c9511015b821

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exe

Filesize
468KB

MD5
baba30cfe48f22a81abd9ee909a51308

SHA1
64361e6e2b47b87e373e1b91f7d3746052ac77fe

SHA256
e960b7dc27b2d301d3f1c0820b480e2439e0758f466637a634596693ce1632f1

SHA512
1887f96b1a1eac3fdfaaa618be280069557c0b7d7fba9f6c2659bd520e4284ccd45785521d5bd0bdfbdd34050f6044d796fb998be58ec2096ce5dff9062b2b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43983.exe

Filesize
468KB

MD5
5f99c2aef85127a2855962430f42a70d

SHA1
bb31a0e029adad9ca80ebf2edb8f875f8532d7fb

SHA256
fd2681a30eb3ace775e65109aa650629a33fe1e8bae06f405943b697fac83f44

SHA512
e848bf92c02f67596e206acc5c464ca8e3b3349da5b5341a6ac8085e045b282246a8dbdd794b74291b2a69ff5f95fb743120716cf66e78aa8bbfbeb4b27134c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44156.exe

Filesize
468KB

MD5
fcefaf460e2bc1caa02402f3fab2b1e5

SHA1
9a0cd1db7b31e2494a593b9637dc5fd3bfcbfd40

SHA256
0bc2febd764162149612e3635c979b0cf27136041f4423914952cf086f7248ee

SHA512
e2bdcc2c92e7b3599bdce638d5643fa32761e311ba172a27e5229373a91ed411fff4931b3462fa77ae87909569921cd9501bbb31e73f9a82d6af9d9dfc4adb62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe

Filesize
468KB

MD5
34aabb4ab35e33d4bc14b2944f1fad8b

SHA1
7e771cc5e6a7bc3726f08f04196831d0bc26d8a4

SHA256
cccb4008ac5ef442e472f104b6330ece1add84979b06524cbbc256e8c1254a26

SHA512
8f1572e85960f4ba841b46373bd4c54ea5b628e773486e17b45e4bc04961eafe4e7ea71774070ee927ece749879aece6119a2240fae568b7b3e6e36318eba808

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe

Filesize
468KB

MD5
c4806e4de32bdaa75f0cf9c32d1c7948

SHA1
f69e79c92abbb86a8f04c7bd3dec746cc61021d1

SHA256
d1edc521750e03b000508069e56f5abb1e9b5ba7528820cd86d2eb844907497e

SHA512
35d24df904a5dc6b595cf8e5f4358eeec66773a053f91c506eb6e30698cb6043cffefc74117ef9ba13a084cfb5b91b8c52bfe2ed313113d33cf2f15b45ab8bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe

Filesize
468KB

MD5
8f5992bb88221f57a576f41cc4395b2a

SHA1
12102c32b5a36673b90914b924115924e88df816

SHA256
a2904e6c6457425950cc46fc385c9880c629dd906043b38d0b63237db803816c

SHA512
18b43817373de187cc114b2914b03eca5bc55c179b88a9f6c07a0e1c41bd74dcf7b8cd4a136c2816f956d135250fe68bcdbe574f4518ea4d2c811acff7e5c8d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe

Filesize
468KB

MD5
641fae6e0d4ffa0f12359a216da75fca

SHA1
59859cba590329e407a57a69ff930910cc74a00c

SHA256
a406622fa681524ad2c61ba06cd484a812f982e88862d8b9574bc14955d6051b

SHA512
e39b52eef026a2d125109b1d2c6062ae259b67f9a13527b381650b363d9265d5e0305dfd981f43c10116fa9c0b142daf75ec369776571bac3ccaa19dc2386b0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5211.exe

Filesize
468KB

MD5
3cbf0c9ecd85039aa6505bd37724e547

SHA1
796615b8516e0007955a0e5bb89bc17da3e912e9

SHA256
64bb17853db7977a65e9ab3ccdc9cfec11123c5387a8d23a2a2f002895e52342

SHA512
395949f6454afd7ab39acfd144b33b8273284a0d97a27bfa2fcb09484afdafcdcd0a2c4fbe50ebb433f508c28d0427d76f8f96606df2a156fe31957ae6ae8b91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe

Filesize
468KB

MD5
9c034932fe4b1fec49892b55c4d70f5f

SHA1
299a697d9a93d656366fafc5927c6666f3b8009a

SHA256
d9dc4f33e2fa59177204d9e8cb710269047a8000bdfb5566de9770f8e200ab66

SHA512
6ff305b47df33d90af61589bf674476ca8ef82e129744c75d9a5d256cd6a3207abbb3341501a47a8002319bbb35abfdaab982795af88bd478d8c04886e45ece9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52931.exe

Filesize
468KB

MD5
f7041590f5edba9b1bac860248d3307a

SHA1
29b600f1c378304ab361856b289707a81c99c898

SHA256
c1b1277d42f077af54a2011f0b818877e9caa54848046eb6b73a9867cce8055f

SHA512
f339fca967c2dbfd0e30721e898c8a2676ce3a63aeaf85bad866228e28769b2606e4f9255c5cf9b0e47deeecaededc7a32fe17541af1fb7ea7886e24de0bd57c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe

Filesize
468KB

MD5
cbe8b79c743d14561589265c01ee0b20

SHA1
f11de5cc60deef9debb5fd7accbf3992eaaec662

SHA256
9ee25e3c39507f1cf1438bcb71de57510c814e71500ff56c06869238c7bc42df

SHA512
e616e9d3b4aab026c9c08e8c9d3b85f8facec91a1a08b00cec617b67293ca730843e7e671553c098bb6cbb81f786558003b43fb20b5478adcf690d8a27948a77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe

Filesize
468KB

MD5
b30328040f1c9019d5e583d499e8a1c7

SHA1
aa495a884c6b5e46bf97fa08390be5e663572916

SHA256
daa3c295e48fbdfae66d880e4fb4bbf724c4553c3f51c581eba306bd8af103a9

SHA512
1adc518a7018454da9ed1f75e1f40065e2c50b54a7ec1fd5d520ec738cc08b08a1370ca63910bd7511dbdb4ac0a13b3f5b37be2e0974b453422e2dd7b268fb44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55235.exe

Filesize
468KB

MD5
a2a1621beb488f0a0fa159aa1d957f9c

SHA1
47de51fff22055c37ca0e2ee3ea4ec6bfad1907a

SHA256
ed0f18f3b791824949690667d56edc9dc25ead5566dbd2224f22ff17b683f635

SHA512
852b5195e46d6b3e3a2fcbe3d7f5f694efd7dd8a9dcb9a1a456b19130fae4af85d90dbd1ec644cf8a5b303c4eb135017628667a12bc03a87a9c69bba61718f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58271.exe

Filesize
468KB

MD5
21e9b5c25409ec4d355257858c912a6f

SHA1
37a8e30b9fc014ff2f1d38bcd2bf1809b1e9bea9

SHA256
1f7b0271265848ef1e9ece683c11e4c5bedc4c450ae19677669d1f874dc9b6d0

SHA512
0ef8fa83f55be526c0f577119b392532db031b8b84714e4d3968aab2185622fbb00824e024296b863e8e840cf4be17a57b9c2c8cfafa32b9b37c9c89c74bd971

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60508.exe

Filesize
468KB

MD5
ba292f59ec0548d7d36f7b7db59476d3

SHA1
b51f55336b964258c60e262cc08adab33881ddf6

SHA256
c44771e5fc09e5c80fd8655ebf4589629ecf95513da450cda330648a04a55714

SHA512
5e81708f2d5773e835ede19f5746824c64fde018f42dbd48d442b816b14a991652244b0e76fabc116972620c30d09117a51d6250db1be93e042c2e3e83d4a7b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe

Filesize
468KB

MD5
5191dc38900b86e0d35d146e049883ab

SHA1
e8dfb49ea5efbd0851fae91ad4c257f78ae95c0c

SHA256
e704592bc73dbe713f244465c6a307db6d4924cb55bf2be70c801d2e5a12deae

SHA512
0d0341ce11e54b89a9fbc124d24c1ebc66981aa62069c570a30ee998a6c43ae822937a5beee681a74efb5ba6a9951c53e56376bb9431e36ef562b147babe1c50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe

Filesize
468KB

MD5
0627d43d864518876458fc1ff80276cf

SHA1
9194a00ae7c0eee4af499345ebea2fd831281617

SHA256
4652d720dec6460e3d9bf7494bc16ef4f6c72467e843259ac3e227640459233c

SHA512
afd9795d3c42349f369c263427012f33caa03a4216f58a74db77e2ad5fef56084dc96c7634ea068ef9385b957929e3f13b7d0972c73b3cf42ae41bf49fed1089

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe

Filesize
468KB

MD5
af04b84d9d6422096a2792f4420cc733

SHA1
435e9988dd72e019de2740795252877702963b9d

SHA256
cae94a88614b20b0d68d3f442af635dbfa2a37d011f338e8537cdde0a183320f

SHA512
89de097b33a96caaf4e0bf610575bf79eefe3cb6f4de3efb63b6c7d5f0616c626cf14f00b99183bf27593e14e467758522c7b7a858dc5d5d6075a034adea17a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe

Filesize
468KB

MD5
b02ec27ade8eea2d41dbc8ff3e9a459f

SHA1
266f0b86882c8ddd7336f94691aac98b5e72ce64

SHA256
e03ccb430c00945f86ea667b30a309b6695963ccf12630657dc7bce96a79cfce

SHA512
160a27debb5760bc59bd5b5a2739308a6832a05dea8531e048bb6bdeb87967175a289271fc5a81d30b620bd20914e9dc6823fc9cf11a8585973c303bc080856f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe

Filesize
468KB

MD5
d0063b759ddc87bdb222847e56354d66

SHA1
038e5b8a403921355a32d897619b21256be7c955

SHA256
eca5ce608eb44b4dcb7414bc49fb7788ebc45cf8968e0225bfacdc1683a1d6ac

SHA512
8a95b8ff9acea3b8b83c921c68a5c75512916532542c2291f327c5838ecd875538896dd0e14f1fcbd869d55dac8ca2db219f8a8e71ed1ed778d136781816645c

Download Submit
memory/224-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/428-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/532-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/536-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/796-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/992-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1020-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1048-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1100-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1116-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1252-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1260-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1308-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1340-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1344-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1408-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1416-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1440-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1668-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1776-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1780-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-2989-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2244-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-2991-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-2985-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2472-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2560-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2672-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-2986-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2976-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3216-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3220-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3472-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3536-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-2988-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3584-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-2990-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3796-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3880-2987-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3992-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4160-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4216-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4224-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4256-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4268-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4276-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4336-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4560-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4684-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4688-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5068-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5076-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5276-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-560-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5364-563-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-565-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13220-2603-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14532-2743-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads