613017527e359875a14e676ee6156d4b02c57b8f0d0532a45ed6150983956633

Analysis

max time kernel
120s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc7430dce42283a825b6f10ef8ba0450N.exe
Size

468KB
MD5

bc7430dce42283a825b6f10ef8ba0450
SHA1

078623b9863edf99c3073e6136e884f6edf846e7
SHA256

613017527e359875a14e676ee6156d4b02c57b8f0d0532a45ed6150983956633
SHA512

af80829c26abef8ae455f4b55dca7b6f083ebf25a55334e4d37bc86b59b6a56b0591c37316741e99254ac19ed16b9ac926881e04d36932456a066d8fdc6f8f79
SSDEEP

3072:ITJDog5d1O8uxbYepbi/ff8/Prhjp7p3ndHeyVpUcpemLjW/G+lM:ITpo4/uxJpW/ffaFozcpZPW/G

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2520	Unicorn-22610.exe
4612	Unicorn-54810.exe
2312	Unicorn-34944.exe
2396	Unicorn-14841.exe
2044	Unicorn-47514.exe
4544	Unicorn-41384.exe
1360	Unicorn-27648.exe
3756	Unicorn-41754.exe
2460	Unicorn-54561.exe
3700	Unicorn-25994.exe
4860	Unicorn-25994.exe
4016	Unicorn-9465.exe
4256	Unicorn-17368.exe
4220	Unicorn-60704.exe
3696	Unicorn-46969.exe
3660	Unicorn-46746.exe
4216	Unicorn-51385.exe
4500	Unicorn-65120.exe
1480	Unicorn-59333.exe
4400	Unicorn-6603.exe
1160	Unicorn-42805.exe
4952	Unicorn-9675.exe
4560	Unicorn-43381.exe
5080	Unicorn-26853.exe
5028	Unicorn-4386.exe
3112	Unicorn-56188.exe
4552	Unicorn-42427.exe
3664	Unicorn-56188.exe
3432	Unicorn-34563.exe
4796	Unicorn-61637.exe
2932	Unicorn-17075.exe
1220	Unicorn-20989.exe
1724	Unicorn-4387.exe
3512	Unicorn-55699.exe
2308	Unicorn-4652.exe
1632	Unicorn-28123.exe
4732	Unicorn-11595.exe
4476	Unicorn-63173.exe
4444	Unicorn-63173.exe
2552	Unicorn-55389.exe
756	Unicorn-13780.exe
4312	Unicorn-55389.exe
1156	Unicorn-35331.exe
2404	Unicorn-45021.exe
1952	Unicorn-38098.exe
4956	Unicorn-27163.exe
1208	Unicorn-27163.exe
4932	Unicorn-40899.exe
4184	Unicorn-36853.exe
368	Unicorn-38699.exe
1804	Unicorn-28228.exe
1920	Unicorn-28493.exe
3336	Unicorn-55035.exe
1772	Unicorn-20133.exe
1524	Unicorn-25539.exe
5032	Unicorn-28107.exe
4144	Unicorn-20133.exe
3400	Unicorn-5716.exe
2228	Unicorn-23322.exe
1620	Unicorn-29261.exe
3448	Unicorn-58404.exe
1588	Unicorn-21477.exe
4776	Unicorn-39851.exe
2372	Unicorn-64237.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5492	1620	WerFault.exe	153
14516	8596	WerFault.exe	415
15452	13072	WerFault.exe	639
15996	12416	WerFault.exe	642

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47133.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	376	dwm.exe
Token: SeChangeNotifyPrivilege	376	dwm.exe
Token: 33	376	dwm.exe
Token: SeIncBasePriorityPrivilege	376	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2232	bc7430dce42283a825b6f10ef8ba0450N.exe
2520	Unicorn-22610.exe
4612	Unicorn-54810.exe
2312	Unicorn-34944.exe
2396	Unicorn-14841.exe
2044	Unicorn-47514.exe
4544	Unicorn-41384.exe
1360	Unicorn-27648.exe
3756	Unicorn-41754.exe
2460	Unicorn-54561.exe
3700	Unicorn-25994.exe
4860	Unicorn-25994.exe
4256	Unicorn-17368.exe
4016	Unicorn-9465.exe
3696	Unicorn-46969.exe
4220	Unicorn-60704.exe
3660	Unicorn-46746.exe
4500	Unicorn-65120.exe
4216	Unicorn-51385.exe
1480	Unicorn-59333.exe
4400	Unicorn-6603.exe
1160	Unicorn-42805.exe
4952	Unicorn-9675.exe
4560	Unicorn-43381.exe
3112	Unicorn-56188.exe
4552	Unicorn-42427.exe
5080	Unicorn-26853.exe
5028	Unicorn-4386.exe
3664	Unicorn-56188.exe
3432	Unicorn-34563.exe
4796	Unicorn-61637.exe
2932	Unicorn-17075.exe
1220	Unicorn-20989.exe
1724	Unicorn-4387.exe
3512	Unicorn-55699.exe
2308	Unicorn-4652.exe
1632	Unicorn-28123.exe
4732	Unicorn-11595.exe
4444	Unicorn-63173.exe
4476	Unicorn-63173.exe
756	Unicorn-13780.exe
4312	Unicorn-55389.exe
1156	Unicorn-35331.exe
1208	Unicorn-27163.exe
4932	Unicorn-40899.exe
4956	Unicorn-27163.exe
368	Unicorn-38699.exe
2404	Unicorn-45021.exe
1952	Unicorn-38098.exe
1804	Unicorn-28228.exe
3336	Unicorn-55035.exe
5032	Unicorn-28107.exe
4184	Unicorn-36853.exe
1920	Unicorn-28493.exe
1524	Unicorn-25539.exe
1772	Unicorn-20133.exe
4144	Unicorn-20133.exe
3400	Unicorn-5716.exe
2228	Unicorn-23322.exe
1620	Unicorn-29261.exe
3448	Unicorn-58404.exe
1588	Unicorn-21477.exe
4776	Unicorn-39851.exe
2372	Unicorn-64237.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2520	2232	bc7430dce42283a825b6f10ef8ba0450N.exe	89
PID 2232 wrote to memory of 2520	2232	bc7430dce42283a825b6f10ef8ba0450N.exe	89
PID 2232 wrote to memory of 2520	2232	bc7430dce42283a825b6f10ef8ba0450N.exe	89
PID 2520 wrote to memory of 4612	2520	Unicorn-22610.exe	93
PID 2520 wrote to memory of 4612	2520	Unicorn-22610.exe	93
PID 2520 wrote to memory of 4612	2520	Unicorn-22610.exe	93
PID 2232 wrote to memory of 2312	2232	bc7430dce42283a825b6f10ef8ba0450N.exe	92
PID 2232 wrote to memory of 2312	2232	bc7430dce42283a825b6f10ef8ba0450N.exe	92
PID 2232 wrote to memory of 2312	2232	bc7430dce42283a825b6f10ef8ba0450N.exe	92
PID 4612 wrote to memory of 2396	4612	Unicorn-54810.exe	95
PID 4612 wrote to memory of 2396	4612	Unicorn-54810.exe	95
PID 4612 wrote to memory of 2396	4612	Unicorn-54810.exe	95
PID 2312 wrote to memory of 2044	2312	Unicorn-34944.exe	96
PID 2312 wrote to memory of 2044	2312	Unicorn-34944.exe	96
PID 2312 wrote to memory of 2044	2312	Unicorn-34944.exe	96
PID 2232 wrote to memory of 4544	2232	bc7430dce42283a825b6f10ef8ba0450N.exe	97
PID 2232 wrote to memory of 4544	2232	bc7430dce42283a825b6f10ef8ba0450N.exe	97
PID 2232 wrote to memory of 4544	2232	bc7430dce42283a825b6f10ef8ba0450N.exe	97
PID 2520 wrote to memory of 1360	2520	Unicorn-22610.exe	98
PID 2520 wrote to memory of 1360	2520	Unicorn-22610.exe	98
PID 2520 wrote to memory of 1360	2520	Unicorn-22610.exe	98
PID 2396 wrote to memory of 3756	2396	Unicorn-14841.exe	101
PID 2396 wrote to memory of 3756	2396	Unicorn-14841.exe	101
PID 2396 wrote to memory of 3756	2396	Unicorn-14841.exe	101
PID 4612 wrote to memory of 2460	4612	Unicorn-54810.exe	102
PID 4612 wrote to memory of 2460	4612	Unicorn-54810.exe	102
PID 4612 wrote to memory of 2460	4612	Unicorn-54810.exe	102
PID 4544 wrote to memory of 3700	4544	Unicorn-41384.exe	103
PID 4544 wrote to memory of 3700	4544	Unicorn-41384.exe	103
PID 4544 wrote to memory of 3700	4544	Unicorn-41384.exe	103
PID 2044 wrote to memory of 4860	2044	Unicorn-47514.exe	104
PID 2044 wrote to memory of 4860	2044	Unicorn-47514.exe	104
PID 2044 wrote to memory of 4860	2044	Unicorn-47514.exe	104
PID 1360 wrote to memory of 4016	1360	Unicorn-27648.exe	105
PID 1360 wrote to memory of 4016	1360	Unicorn-27648.exe	105
PID 1360 wrote to memory of 4016	1360	Unicorn-27648.exe	105
PID 2232 wrote to memory of 4256	2232	bc7430dce42283a825b6f10ef8ba0450N.exe	106
PID 2232 wrote to memory of 4256	2232	bc7430dce42283a825b6f10ef8ba0450N.exe	106
PID 2232 wrote to memory of 4256	2232	bc7430dce42283a825b6f10ef8ba0450N.exe	106
PID 2520 wrote to memory of 4220	2520	Unicorn-22610.exe	107
PID 2520 wrote to memory of 4220	2520	Unicorn-22610.exe	107
PID 2520 wrote to memory of 4220	2520	Unicorn-22610.exe	107
PID 2312 wrote to memory of 3696	2312	Unicorn-34944.exe	108
PID 2312 wrote to memory of 3696	2312	Unicorn-34944.exe	108
PID 2312 wrote to memory of 3696	2312	Unicorn-34944.exe	108
PID 2460 wrote to memory of 3660	2460	Unicorn-54561.exe	109
PID 2460 wrote to memory of 3660	2460	Unicorn-54561.exe	109
PID 2460 wrote to memory of 3660	2460	Unicorn-54561.exe	109
PID 2396 wrote to memory of 4216	2396	Unicorn-14841.exe	110
PID 2396 wrote to memory of 4216	2396	Unicorn-14841.exe	110
PID 2396 wrote to memory of 4216	2396	Unicorn-14841.exe	110
PID 4612 wrote to memory of 4500	4612	Unicorn-54810.exe	111
PID 4612 wrote to memory of 4500	4612	Unicorn-54810.exe	111
PID 4612 wrote to memory of 4500	4612	Unicorn-54810.exe	111
PID 3700 wrote to memory of 1480	3700	Unicorn-25994.exe	112
PID 3700 wrote to memory of 1480	3700	Unicorn-25994.exe	112
PID 3700 wrote to memory of 1480	3700	Unicorn-25994.exe	112
PID 4544 wrote to memory of 4400	4544	Unicorn-41384.exe	113
PID 4544 wrote to memory of 4400	4544	Unicorn-41384.exe	113
PID 4544 wrote to memory of 4400	4544	Unicorn-41384.exe	113
PID 4220 wrote to memory of 1160	4220	Unicorn-60704.exe	114
PID 4220 wrote to memory of 1160	4220	Unicorn-60704.exe	114
PID 4220 wrote to memory of 1160	4220	Unicorn-60704.exe	114
PID 2520 wrote to memory of 4952	2520	Unicorn-22610.exe	115

C:\Users\Admin\AppData\Local\Temp\bc7430dce42283a825b6f10ef8ba0450N.exe
"C:\Users\Admin\AppData\Local\Temp\bc7430dce42283a825b6f10ef8ba0450N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22610.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22610.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5716.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
        8⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28789.exe
        9⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        10⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55061.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57487.exe
        11⤵
        
        PID:18752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        10⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55184.exe
        10⤵
        
        PID:18656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14419.exe
        9⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
        9⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52959.exe
        9⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe
        8⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        9⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
        9⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        8⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44916.exe
        8⤵
        
        PID:15440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51108.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        9⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7784.exe
        10⤵
        
        PID:16824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        9⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        9⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6251.exe
        8⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45788.exe
        8⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        8⤵
        
        PID:18476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21610.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4722.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24904.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15766.exe
        7⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62997.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        8⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        9⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33850.exe
        9⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
        9⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        9⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
        8⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7875.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        8⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48832.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
        7⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe
        7⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        7⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30557.exe
        9⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        9⤵
        
        PID:16532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        8⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25776.exe
        8⤵
        
        PID:17464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
        7⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
        7⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36430.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59267.exe
        6⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13072 -s 436
        8⤵
        Program crash
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe
        7⤵
        
        PID:17168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8600.exe
        6⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        9⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        9⤵
        
        PID:16288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3650.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
        8⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58356.exe
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61607.exe
        8⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15378.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        7⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        7⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19099.exe
        6⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41757.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        8⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe
        8⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe
        7⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        8⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57487.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40187.exe
        7⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
        8⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36735.exe
        8⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        7⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe
        7⤵
        
        PID:18728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14315.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24046.exe
        7⤵
        
        PID:18364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
        6⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        6⤵
        
        PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55699.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        6⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        8⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        8⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
        8⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30012.exe
        7⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        7⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
        6⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe
        8⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        8⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28934.exe
        7⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33530.exe
        6⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63893.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20591.exe
        7⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
        6⤵
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        6⤵
        
        PID:16420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22364.exe
        5⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        8⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        8⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        7⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        7⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6554.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42392.exe
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15722.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        6⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        7⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        7⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26350.exe
        6⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        6⤵
        
        PID:13452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        6⤵
        
        PID:18980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        5⤵
        
        PID:12784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18694.exe
        5⤵
        
        PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46746.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61637.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 632
        8⤵
        Program crash
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4211.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
        8⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        9⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        10⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61240.exe
        10⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        9⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9246.exe
        9⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        8⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36276.exe
        8⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        8⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        8⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42271.exe
        7⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14284.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
        9⤵
        
        PID:18380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        8⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
        8⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43916.exe
        7⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        8⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        8⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        7⤵
        
        PID:18784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        6⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46397.exe
        8⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        8⤵
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        8⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55836.exe
        7⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18731.exe
        6⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4722.exe
        7⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2511.exe
        7⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe
        6⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe
        8⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        9⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
        9⤵
        
        PID:18612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
        8⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        8⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60252.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        7⤵
        
        PID:17488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53220.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
        7⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23174.exe
        8⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe
        7⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55430.exe
        6⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        7⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44904.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48631.exe
        6⤵
        
        PID:15692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39851.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64725.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44712.exe
        9⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
        8⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19910.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22202.exe
        7⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61624.exe
        7⤵
        
        PID:18844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        6⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23267.exe
        7⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
        7⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5482.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
        6⤵
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53205.exe
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        7⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        6⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36527.exe
        6⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        6⤵
        
        PID:15372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62164.exe
        5⤵
        
        PID:10520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        5⤵
        
        PID:16652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20989.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24269.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        8⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        9⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12416 -s 444
        10⤵
        Program crash
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        9⤵
        
        PID:19120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-306.exe
        8⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40000.exe
        8⤵
        
        PID:17440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21139.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
        8⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        8⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31826.exe
        7⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7327.exe
        7⤵
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27947.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        8⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
        8⤵
        
        PID:18336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10779.exe
        7⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe
        7⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43043.exe
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        6⤵
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6439.exe
        6⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12275.exe
        5⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47813.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe
        8⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28567.exe
        8⤵
        
        PID:17412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        7⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        6⤵
        
        PID:13832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        6⤵
        
        PID:17680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8818.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
        6⤵
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
        5⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29026.exe
        5⤵
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49775.exe
        5⤵
        
        PID:16744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30989.exe
        5⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        8⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        7⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        7⤵
        
        PID:16812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        6⤵
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15303.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63229.exe
        7⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        7⤵
        
        PID:16832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15378.exe
        5⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47503.exe
        6⤵
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
        5⤵
        
        PID:13840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        5⤵
        
        PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12395.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
        6⤵
        
        PID:13368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        5⤵
        
        PID:14364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15523.exe
      4⤵
      PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30237.exe
        5⤵
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        5⤵
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29318.exe
        5⤵
        
        PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6180.exe
      4⤵
      PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
        5⤵
        
        PID:12672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61240.exe
        5⤵
        
        PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15426.exe
      4⤵
      PID:12900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
      4⤵
      PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11595.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-724.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12836.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        9⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        9⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11759.exe
        9⤵
        
        PID:19008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        8⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe
        8⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59188.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47964.exe
        8⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45195.exe
        8⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
        8⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
        7⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
        7⤵
        
        PID:16624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30429.exe
        7⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47964.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        8⤵
        
        PID:18860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        7⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
        7⤵
        
        PID:18740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34110.exe
        6⤵
        
        PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        5⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8700.exe
        6⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
        7⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe
        8⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
        7⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        7⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64691.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31832.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31581.exe
        6⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4831.exe
        7⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        6⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23138.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
        5⤵
        
        PID:12468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        5⤵
        
        PID:16352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
        6⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        8⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        7⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe
        6⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        6⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        6⤵
        
        PID:18400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        7⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23437.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        8⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
        7⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        7⤵
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
        6⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5082.exe
        5⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        6⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        6⤵
        
        PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26326.exe
        5⤵
        
        PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
        5⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        6⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
        8⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41715.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39731.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe
        5⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31413.exe
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        6⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
        5⤵
        
        PID:12488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34110.exe
        5⤵
        
        PID:15380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe
      4⤵
      PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14284.exe
        5⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44712.exe
        6⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        5⤵
        
        PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13811.exe
      4⤵
      PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62421.exe
      4⤵
      PID:13304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3126.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60704.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
        5⤵
        Executes dropped EXE
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        6⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2260.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        9⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        8⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        8⤵
        
        PID:16632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7898.exe
        7⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23664.exe
        7⤵
        
        PID:16680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        7⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46789.exe
        8⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        8⤵
        
        PID:100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        7⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12406.exe
        7⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64963.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        6⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43067.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58447.exe
        6⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54492.exe
        5⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62659.exe
        5⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47049.exe
        5⤵
        
        PID:18684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27163.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18893.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        7⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8596 -s 696
        8⤵
        Program crash
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        7⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44415.exe
        7⤵
        
        PID:18328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe
        6⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
        6⤵
        
        PID:12836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56884.exe
        5⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41615.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        5⤵
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        5⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        5⤵
        
        PID:17036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7858.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22261.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        5⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
      4⤵
      PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14416.exe
        5⤵
        
        PID:18584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21714.exe
      4⤵
      PID:12448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48623.exe
      4⤵
      PID:15904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        5⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58477.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        7⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
        7⤵
        
        PID:16640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34891.exe
        6⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        7⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe
        7⤵
        
        PID:17072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39716.exe
        6⤵
        
        PID:13992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59603.exe
        6⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        6⤵
        
        PID:18372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45820.exe
        5⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-306.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
        6⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
        5⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30679.exe
        6⤵
        
        PID:17456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe
        5⤵
        
        PID:14200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38315.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        6⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        7⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49319.exe
        7⤵
        
        PID:18672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19998.exe
        6⤵
        
        PID:15840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27963.exe
        5⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39423.exe
        6⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6171.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe
        5⤵
        
        PID:17084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20842.exe
      4⤵
      PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        5⤵
        
        PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
      4⤵
      PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43059.exe
      4⤵
      PID:13716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
      4⤵
      PID:10736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38098.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34845.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exe
        6⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        7⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42892.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        6⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31334.exe
        5⤵
        
        PID:17024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48332.exe
      4⤵
      PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26885.exe
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49295.exe
        5⤵
        
        PID:16376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4906.exe
      4⤵
      PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
      4⤵
      PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45891.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
      4⤵
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        5⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12615.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
        5⤵
        
        PID:10728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
      4⤵
      PID:11044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
      4⤵
      PID:16688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10980.exe
    3⤵
    PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
      4⤵
      PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
      4⤵
      PID:14796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20602.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18327.exe
    3⤵
    PID:7156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34944.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47514.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43381.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13780.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
        8⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
        9⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        9⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        9⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
        8⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
        8⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24787.exe
        7⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        8⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16721.exe
        9⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
        7⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26326.exe
        7⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        8⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        8⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56528.exe
        8⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60780.exe
        7⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
        6⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47964.exe
        7⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8287.exe
        7⤵
        
        PID:18428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        6⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        6⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe
        6⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        8⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        8⤵
        
        PID:18532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        7⤵
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        6⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11930.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
        6⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21893.exe
        7⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
        7⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
        5⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        6⤵
        
        PID:17708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe
        5⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58224.exe
        5⤵
        
        PID:16028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        6⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34845.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
        8⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        8⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56415.exe
        8⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14419.exe
        7⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48332.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        7⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe
        6⤵
        
        PID:16320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26987.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        6⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        7⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
        6⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-858.exe
        5⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65153.exe
        6⤵
        
        PID:16588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        5⤵
        
        PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38699.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22069.exe
        6⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        7⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34515.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
        6⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        5⤵
        
        PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        5⤵
        
        PID:17000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
      4⤵
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        5⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        6⤵
        
        PID:13916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9246.exe
        6⤵
        
        PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        5⤵
        
        PID:10072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
      4⤵
      PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        5⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63544.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44799.exe
        5⤵
        
        PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
      4⤵
      PID:10428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
      4⤵
      PID:3028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46969.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
        6⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34874.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
        5⤵
        
        PID:13424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe
        5⤵
        
        PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
      4⤵
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8316.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47341.exe
        6⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        7⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe
        7⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        6⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        6⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55839.exe
        5⤵
        
        PID:19096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39853.exe
        5⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        6⤵
        
        PID:16424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-306.exe
        5⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        5⤵
        
        PID:16468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47747.exe
      4⤵
      PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7587.exe
      4⤵
      PID:14252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
      4⤵
      PID:2416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5820.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        6⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        7⤵
        
        PID:13252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe
        7⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
        6⤵
        
        PID:11396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48332.exe
        5⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41877.exe
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19898.exe
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37412.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        5⤵
        
        PID:16072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
      4⤵
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        5⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        6⤵
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        6⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39115.exe
        5⤵
        
        PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        5⤵
        
        PID:16260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        5⤵
        
        PID:18484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55819.exe
      4⤵
      PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        5⤵
        
        PID:12444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45096.exe
        5⤵
        
        PID:17428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
      4⤵
      PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18350.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28228.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
      4⤵
      PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43205.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
        6⤵
        
        PID:14888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        6⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64196.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15879.exe
        5⤵
        
        PID:16660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
      4⤵
      PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3828.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42023.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36628.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
      4⤵
      PID:15944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54835.exe
    3⤵
    PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19085.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5364.exe
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        5⤵
        
        PID:17056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
      4⤵
      PID:9988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
      4⤵
      PID:16332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
    3⤵
    PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
      4⤵
      PID:14624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29912.exe
      4⤵
      PID:17204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
    3⤵
    PID:10452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13359.exe
    3⤵
    PID:7164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41384.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41384.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14844.exe
        6⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46101.exe
        8⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        9⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8286.exe
        9⤵
        
        PID:18692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        8⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58831.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65459.exe
        7⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
        7⤵
        
        PID:18596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4787.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31581.exe
        7⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20399.exe
        8⤵
        
        PID:16476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
        7⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20766.exe
        7⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41699.exe
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45908.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        7⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        8⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        7⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        7⤵
        
        PID:18420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        6⤵
        
        PID:10912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
        6⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
        5⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        6⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61505.exe
        7⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        6⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53368.exe
        6⤵
        
        PID:15924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        5⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        5⤵
        
        PID:15364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27163.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24357.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12644.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55061.exe
        8⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6175.exe
        8⤵
        
        PID:17480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        7⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60367.exe
        7⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22499.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        6⤵
        
        PID:18544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42467.exe
        5⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        6⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-118.exe
        7⤵
        
        PID:18624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        6⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        5⤵
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        5⤵
        
        PID:17732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57635.exe
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30557.exe
        7⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        7⤵
        
        PID:16568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        6⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14151.exe
        6⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22499.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47131.exe
        5⤵
        
        PID:15692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47964.exe
        5⤵
        
        PID:11128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        5⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56336.exe
        5⤵
        
        PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2682.exe
      4⤵
      PID:10904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6555.exe
      4⤵
      PID:16344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
      4⤵
      PID:17908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6603.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5364.exe
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50545.exe
        8⤵
        
        PID:16696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        7⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        7⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
        6⤵
        
        PID:17872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32379.exe
        5⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50045.exe
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        6⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55184.exe
        6⤵
        
        PID:18564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46519.exe
        5⤵
        
        PID:18648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61668.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
        5⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        6⤵
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45171.exe
        5⤵
        
        PID:11196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37412.exe
        5⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe
        5⤵
        
        PID:17132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
      4⤵
      PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        5⤵
        
        PID:12408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36244.exe
      4⤵
      PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe
      4⤵
      PID:4680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
      4⤵
      PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5364.exe
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        6⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27428.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        6⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        5⤵
        
        PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
      4⤵
      PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4722.exe
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57384.exe
        5⤵
        
        PID:16088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46323.exe
      4⤵
      PID:10976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7598.exe
      4⤵
      PID:2000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
    3⤵
    PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52525.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
        5⤵
        
        PID:14120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26158.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64196.exe
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
      4⤵
      PID:18468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
    3⤵
    PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
      4⤵
      PID:13296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31063.exe
      4⤵
      PID:7072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58132.exe
    3⤵
    PID:11708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
    3⤵
    PID:14792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17368.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17368.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26853.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54181.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
        8⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        7⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50279.exe
        7⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
        6⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48332.exe
        5⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe
        6⤵
        
        PID:16048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29794.exe
        5⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37412.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe
        5⤵
        
        PID:18716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5364.exe
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        6⤵
        
        PID:13760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        6⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
        5⤵
        
        PID:16360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37668.exe
      4⤵
      PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13162.exe
      4⤵
      PID:11784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56792.exe
      4⤵
      PID:15892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13988.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2556.exe
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5364.exe
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
        6⤵
        
        PID:14812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
        5⤵
        
        PID:11104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37412.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
        5⤵
        
        PID:18704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe
      4⤵
      PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2627.exe
        5⤵
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34134.exe
        5⤵
        
        PID:17420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
      4⤵
      PID:10592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
      4⤵
      PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe
    3⤵
    PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
      4⤵
      PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38725.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63455.exe
        5⤵
        
        PID:18872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35095.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe
    3⤵
    PID:8880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe
    3⤵
    PID:16576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17181.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53368.exe
        6⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
        5⤵
        
        PID:11576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31756.exe
        5⤵
        
        PID:16292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31802.exe
      4⤵
      PID:7480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21827.exe
      4⤵
      PID:12004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56991.exe
      4⤵
      PID:6804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45715.exe
    3⤵
    PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
      4⤵
      PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
        5⤵
        
        PID:12768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36735.exe
        5⤵
        
        PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42683.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2422.exe
      4⤵
      PID:15972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
    3⤵
    PID:8688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3754.exe
    3⤵
    PID:12812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
    3⤵
    PID:5516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
    3⤵
    PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60501.exe
      4⤵
      PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe
        5⤵
        
        PID:8984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62077.exe
        6⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        5⤵
        
        PID:13548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        5⤵
        
        PID:16552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45171.exe
      4⤵
      PID:11188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23550.exe
      4⤵
      PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32955.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
      4⤵
      PID:8380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
      4⤵
      PID:14576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe
      4⤵
      PID:16368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
    3⤵
    PID:10580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
    3⤵
    PID:15624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe
    3⤵
    PID:3672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe
  2⤵
  PID:5912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
    3⤵
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
      4⤵
      PID:9344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
      4⤵
      PID:13884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
      4⤵
      PID:18908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
    3⤵
    PID:11148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe
    3⤵
    PID:19084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
  2⤵
  PID:8096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
    3⤵
    PID:10188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
    3⤵
    PID:14584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
    3⤵
    PID:18552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
  2⤵
  PID:10460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
  2⤵
  PID:16900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1620 -ip 1620
1⤵
PID:6260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 8596 -ip 8596
1⤵
PID:14140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 13072 -ip 13072
1⤵
PID:15392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 12416 -ip 12416
1⤵
PID:15820

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14841.exe

Filesize
468KB

MD5
78c2b330b6420276daa2b0a350f92b39

SHA1
d2f40cde5cc894c1be3344f7c4aae9bf68a05861

SHA256
35e1a1e7df046851b0f16b5115dfbcda07ba3a0fbac0b6ae4bb1477209dbea62

SHA512
c08438c14dfd411a33cdc4d26c41fc1ec57426fd2b92871373b09820e4bf3a486b8d1dc2bcbd526d9f13452896c174c08013269dccaff9ead7216fd529e4c66d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe

Filesize
468KB

MD5
ddaa3161655da1eff68986dc6f774130

SHA1
76858f15372028291c8ac30f178ea73053ca385d

SHA256
c31b97f0fe6f289848fc5f2e9a2679ca2c1b68778a03c20bf78591fe68630b5d

SHA512
e8572505bd0ecace080a990264e3608c78f76657a1d0efeccdc96cb9cc5b0d004d17cf4e139dd5558ff822368c6a5a1db6552556f8703a1527845782133d8c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17368.exe

Filesize
468KB

MD5
678e7096138848e8abde439b02984b4d

SHA1
3730c897a3cc711bc6d560c1fa677ad7cfe826e0

SHA256
9d2898ca3041250822480d6df4fbd61e3f47f286ded5a7ce25eef9def6194e48

SHA512
10db7874a64df21a40eb09d5bff8e123abd8fa82444658bc8378213bff216e1d5278de256cb78b37089b47efb80be0c4a2cd5c3981599a1f243036013eccc2d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20989.exe

Filesize
468KB

MD5
67c030d2633eae3f73b697903c092eb0

SHA1
a368b0b933f9123db1bd18d79f9f9f78378c9084

SHA256
e646bf83cb81d81854936cbe239ce9e6210f9342e99ccc6676e264d346b86ab1

SHA512
b14a3e1b2b2e8ee459c1709639d663f775c79ad8ffddc36800ab9a69c58492d038f9a93832984b8a164f230b4d675c16bd3fa48a73fc475bc8c211fda0622e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22610.exe

Filesize
468KB

MD5
7f3d7e25370cc3e63a63a1a060053eea

SHA1
0c45d2be88558ffb8630a9fc1b0466e08f3566f1

SHA256
958f51405013756eb74a053e74d497a6716dbaa5dcd3546993ca1e7cb284b0d8

SHA512
5d98839ec6a8e4429cd1ad937fc5d0d4e818f7ce25c894c218d22ab4ce8cc2b6efdc83eb6c19293fff84a307d7a428ffcd7f5ffb430a19cabc23a1ecc55cb6c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe

Filesize
468KB

MD5
c49cab37c03007a4fb5a9112e6edda35

SHA1
6d8fba89087ce361dab83f85e20ce5081ab72cf6

SHA256
cf8244f88876a36e04944e41b8a9a036a17c3695199142c92219e80af132f713

SHA512
9d490b57ba38655f785d7aefe3b36718ab1ff6747b5ad315e631b11b67feb0a33f7165d503ef469309cde0d5230acba0d42a716c4736d4d22982cbed1d772348

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26853.exe

Filesize
468KB

MD5
e7080f76ad4649922521ebb6e06e4fec

SHA1
cdb2b4fa7fab04433d0721a5d66cd9510bf357b4

SHA256
e9b8b69f57073cf3028c5dfecd8cdfdef1eb4a04a9092a583665b18d2ec63432

SHA512
1c11d050b6a15f0647f9a9231ae9dab561f10604f8f548f9ce8b27faed075704fc647c242bef91d78fad01ec2a6e376fa7b183d09a35359b5f37bf232ed09c95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe

Filesize
468KB

MD5
feee40c182b18a81dd6a877823b485ef

SHA1
765ec79fb7349a000a93a4805cfb16b5a53186b6

SHA256
3aa92db2c368ba4edc606b3d44043cbbcf6d5ff162c9b1913cb97c1b30316617

SHA512
3213a3a67296aeb8746587024c8ef533f292c0729f1ea10eb1194dd84958f62defacf502cb9593aaae772c64b33486713fcaf009b0d9db4b762d38740743daa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28789.exe

Filesize
468KB

MD5
33b6478e64a026ae12d850dcd1c55473

SHA1
42fc3ddeaf43f43b81e45f408981b492d6a011f5

SHA256
c72ec55d9aeea9c4f77c10f0b61f7d8a252eb7d40595b9cd7a413885600781af

SHA512
b6963be9c1726be056b36f05844add70887384c91fcf98c8c5429d9d2081e378b8b27242cc7d651dd4a5d663f31851888b0584acad9e39e4a976a24dfce3ad46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe

Filesize
468KB

MD5
fa5490bbf0a776e16d749542bb704f50

SHA1
8c3e930872bf71a825e5ac55197e93418c823438

SHA256
25f27ebc523b9d65854f88e6958a573e31583aebb0911cbda95fcca573067361

SHA512
0a9cc4f5a92a1064c210e25742bfcf23094e04b9d8dbce20a4b4986d1fb11d9a5ec4f8e41727b2e0e350f087b9e92c9dd2d6b3d73f0733612ceaa78106626325

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34944.exe

Filesize
468KB

MD5
648aef35949e4921769c0e5fb2e474d5

SHA1
a863d9e2d32494bab2a6b1fdaadaaebaaa7bf13c

SHA256
4d2897eadc5d3f17b4420a49da490b71a22f95c2ca132b244293d52d5840e9a3

SHA512
ddeacc7e4f57d6dba60a67cbafbc9922cfcaa0ccd982b32027e79425d2498f226d99ce6d8a37e4876188d62d0e484f65e5e565ef7fd1b25626c8a7f1a2533c58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41384.exe

Filesize
468KB

MD5
d5a0dfc06ce5dc76cdbf68ff98e5dde5

SHA1
46cee86b3b3b214e42c2ab3c9eb78872c30fba30

SHA256
398e6d579bfe2cc80f17499b5f2a398cfc1305af40916b1a8ea20d06a2690891

SHA512
a2853295afc908176c5201cb1fce7d037d7a70553ad2c4c67398823050b86fd6261bc57a9430496c0eec5480f5ac18eea1204ad83e13baa88cdf0f290f041f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe

Filesize
468KB

MD5
98e37961ffd8fb5d426d2ca1f3e7a62e

SHA1
f601007df7d969fda446e03a77289662acd224a2

SHA256
f1d4cc188981ef1af22fbf2291ce52bf546148960f6a066873d3a60a337fea47

SHA512
6245eaac6927387f0d572f14ebec1061d93153f2cfb3d5d9d5a402f6498848fc4ff0618ce18870e1c8d9622e14008f0d9f4281ba15441e188800abe6280fe29d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42427.exe

Filesize
468KB

MD5
2d03b25530bdd6a29d6e59175ff6ee5f

SHA1
ae48da1bcb4fa16b400d32daf0c4dae0aa12cf97

SHA256
afadbeccd7fd4fe510b4343597b66b4887dbb00f481319824e20cce0272051fd

SHA512
f80e4ac80f433397e6c6cf59d1bee2c0092508e1027380b1e3f0a683a2a555c04c379f4c56ba72f0974c50520b20e3eff74f044d6cfbcf4a3318ebf6427759f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe

Filesize
468KB

MD5
357f4aa9babc4bf5068bbbbe6fde2fa5

SHA1
ee817c3f448dfc9378f7b4b230fdeacc609d2bc3

SHA256
ed42cfa27cb252a0d65b9489655e4eec106bec88a14400f1e933fc693cfbc5c4

SHA512
25ab4994eda79125415cde420ad2ff9dedd47e301e0afc2155dfa1b5f82221315e98a706bdf3668a496ddb358934d61ee34eee417722cb2a3df224ee29b48e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43381.exe

Filesize
468KB

MD5
4b9771437bd7ff44f53311ff4d4b9a5c

SHA1
801dffac660bd17a749b587e47bc8496af47d3c0

SHA256
5f2940115b27d88b5748c02949247b9b7f57f0e920f0f2c259c1c5316793538b

SHA512
86697f3fd1d082b0ad90f9cca0e08e594b8e339583a394850ed953e2adad0a391720197b1f07b49c3b09202227c4bcbf10ce7df8876498032b1bba16e301abd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4386.exe

Filesize
468KB

MD5
55da93109879ff559cca9b138e00a323

SHA1
e5d7558b45cb80f383ce282253fb91611bd78c78

SHA256
27c4511c112038c59addf7acf08d45e05b8e14563ce9659e7f95f25c6cc53795

SHA512
ee2a8899d69918ab8cff6c2ea195d6568b3442a1975bd0f258fde49cfe2c4160032078d342152aa469a9e5ac8f57e244ef82f40138c1bc0d4fd8eafdc8a5d426

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46746.exe

Filesize
468KB

MD5
2bcb2a73cf5ebe1bdf80d0ba2a450441

SHA1
ac798da2a335c675724f9ad6eb9d5ebb420fb9bc

SHA256
66273565278a83098747288fee05ad3d5d067fa46770d44e8230a2de9969aef9

SHA512
0fe5fdf26c134626629ab2754ab37547b1ce82f740a19d4ef0e9e6080e38773620723d17a759585897315a85ecd5966f232a676fad2df706025290ab15bf80e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46969.exe

Filesize
468KB

MD5
1a6c8256735bd509cc1fb5b10088a802

SHA1
2743e11ad09631043c28898887b9519430298afe

SHA256
6d8dc94e1687278c210955a601bbb229f05b07babed88e9d125abf52e58aadbb

SHA512
2ec8ee093b2b1ad9c8e921d195bc15116590bb52be05098260882af51ff7485e2c4ff67b5adc52f697c6697b3a07af40eeae00511f8365c608d4acd9e9ab0061

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47514.exe

Filesize
468KB

MD5
0809d708e5de86ab26a0f8fd5a27a72d

SHA1
6cae3bf9675d89424848080e6570991d8a5d4f50

SHA256
87ddc65b0afaebf7e6cc0617836dbcab533dc69773dffffad3da88cd9c2ea133

SHA512
4ebaa549eb3d40023cd9a867cae91e532dfd9c7be4c70cad0dfef6cab8044a436ba13e19379c2d035fdb74dbc0db30ca979b52177f94ff4ea76c0c3ffcc3037e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe

Filesize
468KB

MD5
26da93f0c47478d559b67921c96b0549

SHA1
4b35bc098251c78793d90a3109565a4066adbefe

SHA256
ea3ebf03fb6bf87e892a4530bd9a9c43a80fcaf45c4a9778aca8041be5f04f78

SHA512
c8377642d4deecdbc9831eb412a1eb83313ebe067cabb61c2c1c25f7702437fcece3c321e5537a1f4e98088f25b0f1b3d431810c4ed1ed0dce93694cd77f4d76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54561.exe

Filesize
468KB

MD5
f50f98604af49549baf8b0bd58b0548d

SHA1
7a0b716ceda34710c90616234e6c816affbd949e

SHA256
cbeb4e9f2c5fb545045bb1bd060d7fe42fb8a830136208b444ca3406df906795

SHA512
42e67be8f4b8943739f6bf6fb6b8c5842c15ee5b7505465f49b1812ee0328d614264a29cecb4c250235b03d0cbaadac44e776eabf10c2bda761b247440ab33ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe

Filesize
468KB

MD5
3785eebd1c889d5911dfea65151d3c59

SHA1
3ef60bc0e8a0b5a4cf0e1f3b01792c0031d689d7

SHA256
2b3fed028cbe4ca35e7b1b8e8ff27dc463948599b28a81be3fc6c4754061c769

SHA512
cfe6ef537a89c8dfe83c557609a959cb8d5f5b82beda6f1142c32cc63e835132fd3de82c97e014401033d7c6ac10fc10bde9f557fc08b4c89be78681cbc45f45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe

Filesize
468KB

MD5
e2f15930cd47b69e744a966e8568d5ad

SHA1
536351c08ae2576f2acc6e3d934675aaac9becc1

SHA256
5690381b4b5a9c825baf87a57a08fce40b95f5683af0f2fa8bb6b05b22fa36e8

SHA512
87a1c6aca08c375dcd264ff1b44b9cbce2a3bd9a21880944df2059b89827434f1d926c6b0ce0a77fb85db5e967468572b731290f0e937c58555ebf70d9114710

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exe

Filesize
468KB

MD5
caff0a1b2f91b10ee448d6ec3823ef0f

SHA1
fb49fb9b51c9a0f8ad70a732357d397aa16d2c88

SHA256
d086d4cc0bd4d6a6b00307f4a4c8cb9c57996ca0d3b14bf5da23cba5584ffa6e

SHA512
d855ac8158c05181cc870483131ec30e51abb67ff22d5e5ec9ef0b316e6b38e292ea0758f9cfbca881a62bea7dde8e437483f9c828d77d2552776641866ea180

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60704.exe

Filesize
468KB

MD5
6c7a9854e486736e6ff8fa3ae4caa60b

SHA1
14a3671249c5ad67142fbe6b975069d58b9ee26e

SHA256
1adb9689241e2ee10e8453699de983dfc213da59c8b6d946c2d18b0f83e882b4

SHA512
50e56d76229946b4d2e7df4c25ef43df55f1aa47e6b5cd945026df995153bd162d78a388a44135d288cd1e6f836e379356e5c3dd4a02adbce8ac0229b13f9bff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61637.exe

Filesize
468KB

MD5
51e175e605147f66e2242bc695ef0d6e

SHA1
3e58e321762877da58c33688d9c8dc8f02413731

SHA256
5781bde305af7d84ab9929844366e44a08f169db5790aafc79a2ddedb1caec92

SHA512
07ab693355de160242effdad574f6a1bb5f34f7645ae6ea75ef4eb41fe574b187cf377d131e4456e94f022c7c08e7a863ca14f8193a9779e03125c089dfcfe65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe

Filesize
468KB

MD5
15e21a1924cc45d105574a12b82f5996

SHA1
3e53236b81808227b410365e9d0362c4ba3e8fe3

SHA256
d02d67b4e440adf67addd111be774dfa317aa6fc8287ef67bbb992f8395e46dc

SHA512
8352520b3261c6302f980f08cc372199f11e74e67a2c3307de546667d20d08353f66df8ce476845406c5ac6001d9628544e0e32f47ea300fddad0e52e7b6885d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6603.exe

Filesize
468KB

MD5
923324c1dfcb7f554a92f2e506b22a11

SHA1
72acb9a643cb9fcf3931edc38e9ece2951081a2b

SHA256
0da2d298cf5ab5b5649693f2202e03cdbc7db72d54f9e91dfb6106f22fbb3eaa

SHA512
9b6258709e3575e4ffbf14f9977e75abd83aefa8855b7a2cc70094e451feba45df601d1f93a65b1222c07bdda1df4445527a51793285327c0c612d7d537ef35f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe

Filesize
468KB

MD5
2c33ea3a068a83d510488c0827dc3666

SHA1
ed5bafc5c41936b16020ed217159de64ea673570

SHA256
78c641d9b4e9c99ab5e3572d1008e29e8dfd27f14df36aaced25608dc7a4d372

SHA512
68ffe56f4dbaac5550f19c35373f685a07e6c07be149291d215e5c8486df37aac86275953c3b76456def3354b2d4546c0149df50fd5a7612f2e3a9fb9cdce723

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe

Filesize
468KB

MD5
a71489d3cb241e9aca11f4cf3c2960df

SHA1
2163b7ce1df1221bca7f6052cff46a7c1e9cc6a0

SHA256
2fdd1951e5404914261b62742e5761ddda002d0113fa0eddba10d4958d69e547

SHA512
1568dc357e8b5903e2c6ea4df6d9a02884f612c8e50c6f22431669f133bcce9c9eaf98b60835372e26b0fac895036acfcc2b468b2e7fd9a9299b77b1233fafa2

Download Submit
memory/368-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/756-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1220-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1268-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1360-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1620-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1724-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1920-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1952-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2372-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2932-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3204-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3212-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3336-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3400-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3432-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3448-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3512-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3696-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3700-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3756-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4088-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4184-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4216-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4220-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4256-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4444-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4500-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4560-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4612-15-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4776-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4952-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4956-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5268-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5348-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5364-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5400-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5460-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5520-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5540-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5564-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5632-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5648-566-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5672-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5704-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5708-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5736-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5748-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5776-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5812-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5828-567-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13364-2252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13716-2304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads