22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6

Analysis

max time kernel
120s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe
Size

468KB
MD5

355d6af733e10302195aae9094719f70
SHA1

3bde16d5a1f05c41185ccca631f0a9c65db141b6
SHA256

22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6
SHA512

0246237e5870a6728a9276c971f6d2a8a2b0c3be05767558e2c5388c46f61fd129382db38ea5568c70944059ceec2d7892ec508723005d4cc651fa7c68b5c7f2
SSDEEP

3072:DqoNogLdj58U2bxqPzrWff5kChjWXpynmHeuVqlnMi3E3WJTySFlQ:DqCooqU2sPfWffM5YzMi3qGTyS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4956	Unicorn-63013.exe
4440	Unicorn-12463.exe
3492	Unicorn-59012.exe
3896	Unicorn-9095.exe
4000	Unicorn-27469.exe
5112	Unicorn-13734.exe
1180	Unicorn-39987.exe
1616	Unicorn-4404.exe
2508	Unicorn-19406.exe
2172	Unicorn-19672.exe
1192	Unicorn-7018.exe
2168	Unicorn-62349.exe
3848	Unicorn-33246.exe
4940	Unicorn-23554.exe
3808	Unicorn-29685.exe
1456	Unicorn-29301.exe
3816	Unicorn-58444.exe
936	Unicorn-44568.exe
2688	Unicorn-19109.exe
4080	Unicorn-13815.exe
4920	Unicorn-13815.exe
3236	Unicorn-54391.exe
5040	Unicorn-34790.exe
816	Unicorn-48526.exe
3244	Unicorn-13815.exe
4820	Unicorn-13815.exe
1704	Unicorn-59487.exe
1472	Unicorn-25574.exe
4144	Unicorn-28912.exe
3948	Unicorn-36815.exe
4816	Unicorn-52492.exe
1584	Unicorn-6519.exe
116	Unicorn-6052.exe
2588	Unicorn-46123.exe
2088	Unicorn-8858.exe
2564	Unicorn-60660.exe
3932	Unicorn-51423.exe
2440	Unicorn-31133.exe
4556	Unicorn-62166.exe
3040	Unicorn-8356.exe
3528	Unicorn-33629.exe
2980	Unicorn-8356.exe
4444	Unicorn-1925.exe
2408	Unicorn-8055.exe
3796	Unicorn-54604.exe
4740	Unicorn-40728.exe
4700	Unicorn-40728.exe
3124	Unicorn-20862.exe
924	Unicorn-34597.exe
4588	Unicorn-62772.exe
4276	Unicorn-16835.exe
2988	Unicorn-63141.exe
5036	Unicorn-16746.exe
1200	Unicorn-12487.exe
4900	Unicorn-28061.exe
4144	Unicorn-3971.exe
3076	Unicorn-44511.exe
928	Unicorn-44511.exe
3268	Unicorn-65253.exe
3284	Unicorn-18090.exe
3212	Unicorn-31320.exe
4564	Unicorn-59695.exe
2576	Unicorn-22576.exe
624	Unicorn-7116.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
3300	4144	WerFault.exe	121
4952	1456	WerFault.exe	108
2316	4144	WerFault.exe	121
5448	5312	WerFault.exe	194
8152	6340	WerFault.exe	288
10264	7240	WerFault.exe	314

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23872.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17404	dwm.exe
Token: SeChangeNotifyPrivilege	17404	dwm.exe
Token: 33	17404	dwm.exe
Token: SeIncBasePriorityPrivilege	17404	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe
4956	Unicorn-63013.exe
4440	Unicorn-12463.exe
3492	Unicorn-59012.exe
4000	Unicorn-27469.exe
5112	Unicorn-13734.exe
3896	Unicorn-9095.exe
1180	Unicorn-39987.exe
2172	Unicorn-19672.exe
1616	Unicorn-4404.exe
2508	Unicorn-19406.exe
2168	Unicorn-62349.exe
1192	Unicorn-7018.exe
3848	Unicorn-33246.exe
4940	Unicorn-23554.exe
1456	Unicorn-29301.exe
2688	Unicorn-19109.exe
3816	Unicorn-58444.exe
936	Unicorn-44568.exe
4920	Unicorn-13815.exe
3236	Unicorn-54391.exe
1704	Unicorn-59487.exe
4820	Unicorn-13815.exe
5040	Unicorn-34790.exe
4080	Unicorn-13815.exe
3244	Unicorn-13815.exe
816	Unicorn-48526.exe
1472	Unicorn-25574.exe
3948	Unicorn-36815.exe
4144	Unicorn-28912.exe
4816	Unicorn-52492.exe
1584	Unicorn-6519.exe
116	Unicorn-6052.exe
2588	Unicorn-46123.exe
3932	Unicorn-51423.exe
2088	Unicorn-8858.exe
2564	Unicorn-60660.exe
2440	Unicorn-31133.exe
4556	Unicorn-62166.exe
3040	Unicorn-8356.exe
3528	Unicorn-33629.exe
4700	Unicorn-40728.exe
2980	Unicorn-8356.exe
3796	Unicorn-54604.exe
3124	Unicorn-20862.exe
2408	Unicorn-8055.exe
4444	Unicorn-1925.exe
4588	Unicorn-62772.exe
4740	Unicorn-40728.exe
4276	Unicorn-16835.exe
2988	Unicorn-63141.exe
5036	Unicorn-16746.exe
1200	Unicorn-12487.exe
4900	Unicorn-28061.exe
4144	Unicorn-3971.exe
3076	Unicorn-44511.exe
928	Unicorn-44511.exe
3268	Unicorn-65253.exe
3284	Unicorn-18090.exe
3212	Unicorn-31320.exe
4564	Unicorn-59695.exe
2576	Unicorn-22576.exe
2452	Unicorn-55893.exe
624	Unicorn-7116.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4956	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	86
PID 4212 wrote to memory of 4956	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	86
PID 4212 wrote to memory of 4956	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	86
PID 4956 wrote to memory of 4440	4956	Unicorn-63013.exe	87
PID 4956 wrote to memory of 4440	4956	Unicorn-63013.exe	87
PID 4956 wrote to memory of 4440	4956	Unicorn-63013.exe	87
PID 4212 wrote to memory of 3492	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	88
PID 4212 wrote to memory of 3492	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	88
PID 4212 wrote to memory of 3492	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	88
PID 3492 wrote to memory of 3896	3492	Unicorn-59012.exe	91
PID 3492 wrote to memory of 3896	3492	Unicorn-59012.exe	91
PID 3492 wrote to memory of 3896	3492	Unicorn-59012.exe	91
PID 4212 wrote to memory of 4000	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	92
PID 4212 wrote to memory of 4000	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	92
PID 4212 wrote to memory of 4000	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	92
PID 4956 wrote to memory of 5112	4956	Unicorn-63013.exe	93
PID 4956 wrote to memory of 5112	4956	Unicorn-63013.exe	93
PID 4956 wrote to memory of 5112	4956	Unicorn-63013.exe	93
PID 4440 wrote to memory of 1180	4440	Unicorn-12463.exe	96
PID 4440 wrote to memory of 1180	4440	Unicorn-12463.exe	96
PID 4440 wrote to memory of 1180	4440	Unicorn-12463.exe	96
PID 4000 wrote to memory of 1616	4000	Unicorn-27469.exe	98
PID 4000 wrote to memory of 1616	4000	Unicorn-27469.exe	98
PID 4000 wrote to memory of 1616	4000	Unicorn-27469.exe	98
PID 4212 wrote to memory of 2508	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	99
PID 4212 wrote to memory of 2508	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	99
PID 4212 wrote to memory of 2508	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	99
PID 5112 wrote to memory of 2172	5112	Unicorn-13734.exe	100
PID 5112 wrote to memory of 2172	5112	Unicorn-13734.exe	100
PID 5112 wrote to memory of 2172	5112	Unicorn-13734.exe	100
PID 4956 wrote to memory of 1192	4956	Unicorn-63013.exe	101
PID 4956 wrote to memory of 1192	4956	Unicorn-63013.exe	101
PID 4956 wrote to memory of 1192	4956	Unicorn-63013.exe	101
PID 3896 wrote to memory of 2168	3896	Unicorn-9095.exe	102
PID 3896 wrote to memory of 2168	3896	Unicorn-9095.exe	102
PID 3896 wrote to memory of 2168	3896	Unicorn-9095.exe	102
PID 3492 wrote to memory of 3848	3492	Unicorn-59012.exe	103
PID 3492 wrote to memory of 3848	3492	Unicorn-59012.exe	103
PID 3492 wrote to memory of 3848	3492	Unicorn-59012.exe	103
PID 4440 wrote to memory of 4940	4440	Unicorn-12463.exe	104
PID 4440 wrote to memory of 4940	4440	Unicorn-12463.exe	104
PID 4440 wrote to memory of 4940	4440	Unicorn-12463.exe	104
PID 1180 wrote to memory of 3808	1180	Unicorn-39987.exe	105
PID 1180 wrote to memory of 3808	1180	Unicorn-39987.exe	105
PID 1180 wrote to memory of 3808	1180	Unicorn-39987.exe	105
PID 1616 wrote to memory of 1456	1616	Unicorn-4404.exe	108
PID 1616 wrote to memory of 1456	1616	Unicorn-4404.exe	108
PID 1616 wrote to memory of 1456	1616	Unicorn-4404.exe	108
PID 4000 wrote to memory of 3816	4000	Unicorn-27469.exe	109
PID 4000 wrote to memory of 3816	4000	Unicorn-27469.exe	109
PID 4000 wrote to memory of 3816	4000	Unicorn-27469.exe	109
PID 2508 wrote to memory of 936	2508	Unicorn-19406.exe	110
PID 2508 wrote to memory of 936	2508	Unicorn-19406.exe	110
PID 2508 wrote to memory of 936	2508	Unicorn-19406.exe	110
PID 4212 wrote to memory of 2688	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	111
PID 4212 wrote to memory of 2688	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	111
PID 4212 wrote to memory of 2688	4212	22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe	111
PID 2168 wrote to memory of 4080	2168	Unicorn-62349.exe	112
PID 2168 wrote to memory of 4080	2168	Unicorn-62349.exe	112
PID 2168 wrote to memory of 4080	2168	Unicorn-62349.exe	112
PID 3848 wrote to memory of 4920	3848	Unicorn-33246.exe	113
PID 3848 wrote to memory of 4920	3848	Unicorn-33246.exe	113
PID 3848 wrote to memory of 4920	3848	Unicorn-33246.exe	113
PID 4956 wrote to memory of 3236	4956	Unicorn-63013.exe	114

C:\Users\Admin\AppData\Local\Temp\22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe
"C:\Users\Admin\AppData\Local\Temp\22b5bd67d3b5d7a436c237b8d5accc37b1c9168a9899dea8a2be28ad2e7298a6N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63013.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63013.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12463.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39987.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
        5⤵
        Executes dropped EXE
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25574.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52965.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21910.exe
        9⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
        8⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe
        9⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
        8⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5342.exe
        8⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe
        7⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        8⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe
        8⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
        7⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        8⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
        8⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        7⤵
        
        PID:15320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14255.exe
        7⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        7⤵
        
        PID:17936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
        6⤵
        
        PID:16616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41408.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52472.exe
        7⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        8⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43710.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
        7⤵
        
        PID:14812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        6⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        7⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31565.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        6⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3079.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        7⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15334.exe
        6⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49604.exe
        7⤵
        
        PID:16948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6405.exe
        7⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40755.exe
        6⤵
        
        PID:17856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52006.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12230.exe
        5⤵
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62989.exe
        5⤵
        
        PID:16812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 484
        6⤵
        Program crash
        
        PID:3300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 488
        6⤵
        Program crash
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3971.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56504.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        8⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43429.exe
        9⤵
        
        PID:17344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        8⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26093.exe
        8⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        7⤵
        
        PID:17848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44148.exe
        6⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        7⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36547.exe
        7⤵
        
        PID:19344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
        6⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
        6⤵
        
        PID:16376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        5⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        6⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        7⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        7⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        6⤵
        
        PID:16692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44143.exe
        5⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24920.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50180.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27475.exe
        5⤵
        
        PID:17068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56925.exe
        8⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
        8⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30989.exe
        7⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
        7⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        6⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        7⤵
        
        PID:17608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5525.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe
        6⤵
        
        PID:19064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        5⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10863.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22382.exe
        7⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22786.exe
        6⤵
        
        PID:18012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        5⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
        6⤵
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5626.exe
        5⤵
        
        PID:13224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28736.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44316.exe
        7⤵
        
        PID:17088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        6⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
        5⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30506.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        5⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        5⤵
        
        PID:16792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47182.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53624.exe
        5⤵
        
        PID:6340
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6340 -s 492
        6⤵
        Program crash
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
        5⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12978.exe
        5⤵
        
        PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
      4⤵
      PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
      4⤵
      PID:11056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe
      4⤵
      PID:16544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8055.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10572.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41912.exe
        9⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
        10⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe
        10⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36299.exe
        9⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe
        9⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24371.exe
        8⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45547.exe
        8⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42012.exe
        8⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5517.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
        7⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        8⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        8⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
        7⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22786.exe
        7⤵
        
        PID:18716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        6⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15518.exe
        7⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24981.exe
        7⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5342.exe
        7⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44356.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16997.exe
        7⤵
        
        PID:15508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
        6⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20862.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34392.exe
        6⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        8⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        9⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        9⤵
        
        PID:18204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
        8⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
        8⤵
        
        PID:17920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
        7⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        7⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe
        7⤵
        
        PID:18476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
        7⤵
        
        PID:14460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        6⤵
        
        PID:16640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11055.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        7⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
        6⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exe
        5⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        6⤵
        
        PID:17676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        5⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58887.exe
        5⤵
        
        PID:16868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10572.exe
        6⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        8⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        9⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        9⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2366.exe
        8⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
        8⤵
        
        PID:17600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54207.exe
        8⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59163.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        7⤵
        
        PID:17840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        8⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
        8⤵
        
        PID:17812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53019.exe
        7⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        7⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34074.exe
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        6⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53990.exe
        6⤵
        
        PID:17524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14526.exe
        5⤵
        
        PID:228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe
        6⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
        7⤵
        
        PID:16252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47388.exe
        6⤵
        
        PID:18336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37702.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        6⤵
        
        PID:18564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
        5⤵
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58894.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34597.exe
      4⤵
      Executes dropped EXE
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18056.exe
        5⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59896.exe
        7⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36147.exe
        7⤵
        
        PID:18312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22259.exe
        6⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        7⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        7⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15579.exe
        6⤵
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        5⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
        6⤵
        
        PID:18416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30322.exe
        5⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23748.exe
        5⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19837.exe
        5⤵
        
        PID:9376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41143.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe
        6⤵
        
        PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
        5⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        5⤵
        
        PID:16816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22717.exe
        5⤵
        
        PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
      4⤵
      PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63653.exe
        5⤵
        
        PID:12088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
        5⤵
        
        PID:17896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
      4⤵
      PID:10928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
      4⤵
      PID:17180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7018.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33629.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2212.exe
        6⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        7⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        8⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64525.exe
        9⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        9⤵
        
        PID:18424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2366.exe
        8⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15845.exe
        8⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        7⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32120.exe
        7⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        7⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        7⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31090.exe
        6⤵
        
        PID:9652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39015.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        7⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe
        7⤵
        
        PID:14440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10640.exe
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        6⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39155.exe
        5⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58863.exe
        6⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37000.exe
        7⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        6⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35650.exe
        5⤵
        
        PID:17124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18248.exe
        5⤵
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        8⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        8⤵
        
        PID:18004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58884.exe
        7⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe
        6⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        6⤵
        
        PID:17376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        6⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5517.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        5⤵
        
        PID:14976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60166.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-199.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe
        6⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        6⤵
        
        PID:14272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        6⤵
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57319.exe
        5⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        5⤵
        
        PID:15256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5342.exe
        5⤵
        
        PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5118.exe
      4⤵
      PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        5⤵
        
        PID:15264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50774.exe
      4⤵
      PID:10372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11214.exe
      4⤵
      PID:4724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31133.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33925.exe
        5⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5511.exe
        8⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32459.exe
        7⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        7⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe
        6⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23872.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        7⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
        6⤵
        
        PID:18376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45958.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
        6⤵
        
        PID:18576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36956.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        5⤵
        
        PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
      4⤵
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19800.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9735.exe
        7⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54207.exe
        7⤵
        
        PID:16736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7550.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        5⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56165.exe
        6⤵
        
        PID:12788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
        6⤵
        
        PID:18608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
        6⤵
        
        PID:10864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        5⤵
        
        PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
      4⤵
      PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        5⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        6⤵
        
        PID:13992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        6⤵
        
        PID:17636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2366.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        5⤵
        
        PID:17328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
      4⤵
      PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
      4⤵
      PID:13648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54520.exe
      4⤵
      PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
      4⤵
      PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        6⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        6⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35939.exe
        5⤵
        
        PID:18460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
      4⤵
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21085.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        6⤵
        
        PID:17768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        5⤵
        
        PID:11088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
        5⤵
        
        PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
      4⤵
      PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        5⤵
        
        PID:12776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        5⤵
        
        PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11795.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53990.exe
      4⤵
      PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41598.exe
    3⤵
    PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
        5⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        6⤵
        
        PID:13984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60612.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51790.exe
        5⤵
        
        PID:15104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
        5⤵
        
        PID:18320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
      4⤵
      PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        5⤵
        
        PID:13772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        5⤵
        
        PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
      4⤵
      PID:13328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
      4⤵
      PID:18072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42069.exe
    3⤵
    PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
      4⤵
      PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
      4⤵
      PID:16260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
    3⤵
    PID:9612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46390.exe
    3⤵
    PID:15416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42190.exe
    3⤵
    PID:8640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59012.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59012.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18248.exe
        7⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        8⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
        9⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        10⤵
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60612.exe
        9⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
        9⤵
        
        PID:16176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
        8⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        9⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        9⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        8⤵
        
        PID:17888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        8⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        8⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62043.exe
        7⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3667.exe
        7⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11143.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        8⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43997.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53019.exe
        8⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        8⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20339.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        7⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        7⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7269.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        7⤵
        
        PID:17964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46659.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41974.exe
        6⤵
        
        PID:17320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11148.exe
        6⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
        8⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21656.exe
        9⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
        9⤵
        
        PID:17804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36491.exe
        8⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        8⤵
        
        PID:17648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe
        8⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35763.exe
        8⤵
        
        PID:16832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14861.exe
        7⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        7⤵
        
        PID:17832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33758.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        7⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47375.exe
        6⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        5⤵
        
        PID:5312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 632
        6⤵
        Program crash
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        5⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        6⤵
        
        PID:14072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
        6⤵
        
        PID:18408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        5⤵
        
        PID:10952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48606.exe
        5⤵
        
        PID:16844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32280.exe
        6⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
        8⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        9⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38054.exe
        9⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        8⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2213.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26763.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        8⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        8⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
        7⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        6⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        8⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        8⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        7⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        7⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52484.exe
        7⤵
        
        PID:18656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28879.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        5⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe
        6⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        7⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        7⤵
        
        PID:18300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15627.exe
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40084.exe
        6⤵
        
        PID:15128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58863.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33591.exe
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18242.exe
        5⤵
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
        5⤵
        
        PID:10140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1925.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3567.exe
        6⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        7⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        7⤵
        
        PID:17912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15949.exe
        6⤵
        
        PID:18344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe
        5⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-716.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        6⤵
        
        PID:18080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55324.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        5⤵
        
        PID:18116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52415.exe
        5⤵
        
        PID:10152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-686.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        5⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        6⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15334.exe
        5⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        5⤵
        
        PID:15524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
      4⤵
      PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        5⤵
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        5⤵
        
        PID:18364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
      4⤵
      PID:12204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
      4⤵
      PID:16420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33246.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6052.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18456.exe
        8⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        9⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        9⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
        8⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35262.exe
        8⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51055.exe
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        8⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35187.exe
        8⤵
        
        PID:19096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        7⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16438.exe
        7⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38667.exe
        6⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        8⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        8⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        7⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        7⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
        7⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        6⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42286.exe
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
        6⤵
        
        PID:18444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20774.exe
        5⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1740.exe
        6⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12783.exe
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        8⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        8⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        7⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe
        7⤵
        
        PID:16592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43867.exe
        6⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51405.exe
        7⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        6⤵
        
        PID:18192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51910.exe
        5⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        6⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56413.exe
        7⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6398.exe
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        6⤵
        
        PID:16424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
        6⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62399.exe
        5⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59814.exe
        5⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37454.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:19120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51423.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64760.exe
        5⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        6⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        7⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57701.exe
        8⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        8⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        7⤵
        
        PID:17316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6914.exe
        6⤵
        
        PID:14380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe
        5⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29120.exe
        6⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7240 -s 632
        7⤵
        Program crash
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44507.exe
        6⤵
        
        PID:16580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
        5⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        6⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13527.exe
        7⤵
        
        PID:17276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        6⤵
        
        PID:17532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        5⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53990.exe
        5⤵
        
        PID:17716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20778.exe
      4⤵
      PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
        6⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        5⤵
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35763.exe
        5⤵
        
        PID:16412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
      4⤵
      PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        5⤵
        
        PID:11256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47959.exe
        5⤵
        
        PID:16908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3130.exe
      4⤵
      PID:10056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38776.exe
      4⤵
      PID:18104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40728.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18056.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13468.exe
        6⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58717.exe
        8⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        7⤵
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
        6⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        5⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        6⤵
        
        PID:18292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
        5⤵
        
        PID:12224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        5⤵
        
        PID:17976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5398.exe
      4⤵
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        6⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
        6⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9714.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39155.exe
      4⤵
      PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        5⤵
        
        PID:15088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
      4⤵
      PID:10716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65334.exe
      4⤵
      PID:16524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28736.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
        6⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15334.exe
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
        5⤵
        
        PID:18236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26763.exe
      4⤵
      PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        5⤵
        
        PID:11616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        5⤵
        
        PID:18384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56454.exe
      4⤵
      PID:12252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
      4⤵
      PID:16708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51512.exe
      4⤵
      PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
        5⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8343.exe
        6⤵
        
        PID:16512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        5⤵
        
        PID:15336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43710.exe
      4⤵
      PID:14932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18942.exe
    3⤵
    PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
      4⤵
      PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5470.exe
      4⤵
      PID:14968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1335.exe
    3⤵
    PID:10760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe
    3⤵
    PID:16856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27469.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27469.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4404.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1456
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 720
        5⤵
        Program crash
        
        PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52492.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7422.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        7⤵
        
        PID:18308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7262.exe
        7⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4365.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe
        6⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3198.exe
        5⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        7⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        7⤵
        
        PID:18452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4710.exe
        6⤵
        
        PID:17592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        5⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe
        6⤵
        
        PID:14060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2022.exe
        6⤵
        
        PID:16552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60996.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53990.exe
        5⤵
        
        PID:17736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18090.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56805.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        6⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47112.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        7⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-490.exe
        7⤵
        
        PID:19312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25907.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36523.exe
        6⤵
        
        PID:14488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        5⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63565.exe
        6⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58815.exe
        6⤵
        
        PID:18592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        5⤵
        
        PID:12944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        5⤵
        
        PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15004.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
        6⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        5⤵
        
        PID:10528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38358.exe
      4⤵
      PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        5⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        5⤵
        
        PID:17056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52132.exe
      4⤵
      PID:11252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27200.exe
        6⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42661.exe
        8⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
        7⤵
        
        PID:17928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20165.exe
        6⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41071.exe
        5⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34766.exe
        5⤵
        
        PID:16972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13468.exe
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7231.exe
        6⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe
        6⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        5⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        5⤵
        
        PID:15328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
      4⤵
      PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        5⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        5⤵
        
        PID:18028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe
      4⤵
      PID:10536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
      4⤵
      PID:18052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
      4⤵
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59384.exe
        5⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54413.exe
        6⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        7⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        7⤵
        
        PID:16676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        6⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
        6⤵
        
        PID:16508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
        5⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        6⤵
        
        PID:13808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
        6⤵
        
        PID:18252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5734.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46891.exe
        5⤵
        
        PID:18124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33946.exe
        6⤵
        
        PID:17620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2366.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
        5⤵
        
        PID:18388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32517.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18917.exe
        5⤵
        
        PID:16368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21302.exe
      4⤵
      PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
      4⤵
      PID:18172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1262.exe
    3⤵
    PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58424.exe
      4⤵
      PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64221.exe
        5⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9071.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        6⤵
        
        PID:18372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1702.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5005.exe
        5⤵
        
        PID:19084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51943.exe
      4⤵
      PID:8844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
      4⤵
      PID:14308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
      4⤵
      PID:18016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8757.exe
    3⤵
    PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
      4⤵
      PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21234.exe
      4⤵
      PID:14584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10878.exe
    3⤵
    PID:9524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49520.exe
    3⤵
    PID:15368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22680.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        6⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
        7⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        7⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13990.exe
        6⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        6⤵
        
        PID:15220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        5⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        6⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51415.exe
        6⤵
        
        PID:18392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        5⤵
        
        PID:11160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54788.exe
        5⤵
        
        PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
      4⤵
      PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13166.exe
        6⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
        5⤵
        
        PID:14836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3603.exe
      4⤵
      PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        5⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        5⤵
        
        PID:16440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
      4⤵
      PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48798.exe
      4⤵
      PID:16568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41024.exe
      4⤵
      PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57464.exe
        5⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21144.exe
        6⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30654.exe
        7⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38067.exe
        6⤵
        
        PID:16892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        5⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
        6⤵
        
        PID:11548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1254.exe
        6⤵
        
        PID:17860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        5⤵
        
        PID:11848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13838.exe
        5⤵
        
        PID:18156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1574.exe
        5⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20208.exe
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        5⤵
        
        PID:11512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48639.exe
        5⤵
        
        PID:812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63654.exe
      4⤵
      PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62143.exe
      4⤵
      PID:12684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8066.exe
      4⤵
      PID:15452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
    3⤵
    PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58808.exe
      4⤵
      PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4828.exe
        5⤵
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61240.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49604.exe
        6⤵
        
        PID:16980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64831.exe
        5⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        5⤵
        
        PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
      4⤵
      PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17272.exe
        5⤵
        
        PID:15440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
      4⤵
      PID:16904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
    3⤵
    PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44792.exe
      4⤵
      PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26317.exe
        5⤵
        
        PID:15428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
      4⤵
      PID:10912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3894.exe
      4⤵
      PID:9912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4061.exe
    3⤵
    PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14556.exe
      4⤵
      PID:12020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
      4⤵
      PID:16624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30891.exe
    3⤵
    PID:11992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54520.exe
    3⤵
    PID:17944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6519.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31320.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54309.exe
        6⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47112.exe
        7⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        7⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        7⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        6⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe
        7⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35955.exe
        7⤵
        
        PID:17300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
        6⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        6⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        6⤵
        
        PID:18400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        5⤵
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
        5⤵
        
        PID:18044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe
      4⤵
      PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20568.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
        6⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        5⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
        5⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29847.exe
        5⤵
        
        PID:10564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        5⤵
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
        5⤵
        
        PID:16464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
      4⤵
      PID:18184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59695.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31040.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62685.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
        5⤵
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20526.exe
        5⤵
        
        PID:10152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
      4⤵
      PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        5⤵
        
        PID:13876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
        5⤵
        
        PID:8452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14861.exe
      4⤵
      PID:12700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
      4⤵
      PID:17724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
    3⤵
    PID:224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19608.exe
      4⤵
      PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38272.exe
        5⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        5⤵
        
        PID:16732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe
      4⤵
      PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
      4⤵
      PID:4808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
    3⤵
    PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
      4⤵
      PID:11780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
      4⤵
      PID:18260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe
    3⤵
    PID:10900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46123.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46123.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45669.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        6⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        6⤵
        
        PID:18064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32542.exe
        5⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56423.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
      4⤵
      PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15437.exe
      4⤵
      PID:12048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
      4⤵
      PID:17540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38174.exe
    3⤵
    PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4247.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60612.exe
      4⤵
      PID:12260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31452.exe
      4⤵
      PID:18468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
    3⤵
    PID:7248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
    3⤵
    PID:15392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31262.exe
    3⤵
    PID:10548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55893.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55893.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
    3⤵
    PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63245.exe
      4⤵
      PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        5⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        5⤵
        
        PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe
      4⤵
      PID:11636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62655.exe
      4⤵
      PID:16944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37811.exe
    3⤵
    PID:8476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61925.exe
      4⤵
      PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
      4⤵
      PID:18148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16101.exe
    3⤵
    PID:12932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62847.exe
    3⤵
    PID:18216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
  2⤵
  PID:5564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
    3⤵
    PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
      4⤵
      PID:9324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
      4⤵
      PID:15280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
      4⤵
      PID:8568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48308.exe
    3⤵
    PID:10744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
    3⤵
    PID:16936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
  2⤵
  PID:7848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:17356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
  2⤵
  PID:11732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62556.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62556.exe
  2⤵
  PID:17988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4144 -ip 4144
1⤵
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1456 -ip 1456
1⤵
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4144 -ip 4144
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5312 -ip 5312
1⤵
PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6340 -ip 6340
1⤵
PID:8972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7240 -ip 7240
1⤵
PID:9888

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12463.exe

Filesize
468KB

MD5
f81c5eafd8d193b029b6b6073d0278fa

SHA1
e82e09ecf31e9c6bbde6b42c86b353ce9419b831

SHA256
0f49abdcd3acc87cf23a79c842f7690a5e4775b4f68602713001e896338e051f

SHA512
7b92b8986d6b99791991c96bdaf4579f48a1b3b9f7baa605727a4edccc0558bab21d4b3805372dc27e9dcfcfb6e35bb7a914aa594da0e310669c7b2d42ff97c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe

Filesize
468KB

MD5
80564334fc70b83d4410963a9ada8098

SHA1
5c4eabba131d9e764bb2c8dc8349879713c68aaf

SHA256
32bed56fed4ab47b2e86ceeed92353e95ae0840285fe42626a5d2a7534246206

SHA512
6da4321493ae8dde657323f56db4a2d59a26b56afbb68f2ad202160a58c0722022229cb8c05ac769ac456ffb34f3bc4046e9cd99fc59aabf174b35005286ba5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe

Filesize
468KB

MD5
110df6622adc4964aaa28f8559541f51

SHA1
efd2079a2361cc5df59c36de4c7580cb7ca6b866

SHA256
ebc414969a753f9f5b24c9c530c8d104695760c0673682b4fcd0a0ba41a6bce8

SHA512
6c82662e90a6fade970b1d6dcb71eff75b01478d461412f748d1d688afb3f22cd1c295a53a66c0f4e5d9e81f0f3f154af3ed5f627f8b72b96868db1c687beada

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe

Filesize
468KB

MD5
7f17e288841dc612bcabb85e25588592

SHA1
9e8453d99f94b0209320033244a6b841effa0d83

SHA256
28bea5d9dba232d624bbfc4a01321699fab9e19fcbd1498467d409b820836462

SHA512
8d529b692dc773aa00abfbb85daf48311f2e424ec4c6d6376e7aff60a91cc24077cd5da78ad68c9986acd2a94c3d513faf920c329da327ac4bf1b9f2c69bf9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe

Filesize
468KB

MD5
6c4977a77486110c252eec15fee65225

SHA1
9bce25609f5f9922c0a03afcbe35a603254817f3

SHA256
d26edca4147b34df932f56a7fa5686596229afdaed6e66391796c6e95a54dbc0

SHA512
8f501a8d4a9fe3272e02c2f4d8df8f8c2205defb3139a08955e88db693e50455bc777219490864d4ac1c36520af758a9c254086dfddf257b57b04c02e866817f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe

Filesize
468KB

MD5
9330a0f197d2323dcd3def995ce34d83

SHA1
c9ba0ff134d890ac1661ef329753abeed5a9d4b6

SHA256
417c8113eae39ad7cc357a661d0bdd3c858e88581c61c09890bdb1a4622c8db2

SHA512
c8310e4587abacf554a7435cc47fa209f54ce0abad7a85bb65b3aed2836996e7048ab0e9c26a6a8467949e57fb36cdd3797305bc7ba3d9289e48cd14060f2fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe

Filesize
468KB

MD5
0da93ec37c2de26cc1c2896ffcaad052

SHA1
53325319daf279d3b34c0f2d0a53c001bf979a9c

SHA256
6d5bbdc2026ce766823630837480390a3f2d3a5c60bbae6b17e8fa62ac674358

SHA512
f480d8b15ec0d7d212208c3fce56282cd0a555357b3a5adeef6790520460ad595e36efaf3abf4f1a28028abba932e31847fd258ece365030b4288cadb855d396

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25574.exe

Filesize
468KB

MD5
9e634d6a2d81215875188f644e92a52e

SHA1
0e6efddd7bcba88007627e9ba6abf2ca23f181e7

SHA256
451ba7dbc61b896bbfcf142b56e17fc430494e27165066f5854cf71874c7d593

SHA512
a41c5fde1e40692d35df19dfda13bfe02b9aa2aac6e4b4a7d454d5b28923ba29f6ca22f977180ce118f59d45c64f1f6e15a14f933cd7595caf71d0ccf1c4b319

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27469.exe

Filesize
468KB

MD5
c8f9ef7b76c82eb309b4db30ad4c5f2f

SHA1
f0347a0ab70166a6533a12024316b41b923fdf98

SHA256
05a869ad237d028128e0a3c02883c37f8336858328765e4dabdecbea00224b75

SHA512
f15233db5e391730c7055cf28c443d1498655ab8c00defa057911266908a51a006be9e94790cfdc0f70a139b39f0482d442b3edfb003d5112a9ba06450fae115

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe

Filesize
468KB

MD5
ff094a9a5873c96c2721ca6eba86f49a

SHA1
0a15b82261a6f99335a57a7bae485a613db0b45b

SHA256
2f2f5fa709049ba9757d6d051f1551657f6baac60ff71046db8dc186342dd03d

SHA512
3f31987f9fdafa060f9c24ae082a01b69963290a6d215e81bcbdfc8b73d106d8b7f8127a682dadd07f05b0c9c483712851cbe9b282e8d200678d97b6a0036e15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29120.exe

Filesize
468KB

MD5
fbeb91966ea4441a5cdaf10a7c147b8f

SHA1
93eb3e0c67c68e7a6bd4f226afb92ea1fd21f0a0

SHA256
54e1693221b6d7f751d0a3bd08bbed2801dfcd004446ca1db354985db27e38ab

SHA512
1e5a8a720dfce796d27e81613d914ff4a719949dc698944f1339d4eb9f8d62a0f60ab8441813149fae84a4538f14837e2cb29a2d691d4768fc88fa94b533b2db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe

Filesize
468KB

MD5
874cc59197be59a99455e931df7557d8

SHA1
ab913d8fd466c9040161fd7412483959b26ff95d

SHA256
22cc8b4f564802fd700764195beae452016400ef15b4ae593da3c60500a73d76

SHA512
e39f68a1274d4a255b04f9370c7425823fe452d4838fcfdc214b2dfec7eee362e2520b60d5469affb735f6a45b85ae1af1594ab4641e649d077e00562a5310e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe

Filesize
468KB

MD5
4ddf61f9cdabb7eeab22159fbe174dcd

SHA1
39442d471be0d7ad741577177da6f1b957f04d1e

SHA256
8456a7e247501f51e47e74a1ae7714a01547d666958541d8967af48eec52ad3f

SHA512
4604e62e3d408d0dc58a31f8270554b7de9430b42d2550d6801ce0b8445c897b6c1b518c4037ea67de76caa1e421fe7a92c5d0cda777b7d2674c4eebc858da92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33246.exe

Filesize
468KB

MD5
145d7f5aaa19774350b23b42c5fd7eac

SHA1
f600ab6f00b130d4d344507e025b177260977737

SHA256
b3498a015c3b40f1bcc7b8a18573caa14c7a46b58ecf83e27906aa28f80af9db

SHA512
0fa29bc9eb6afee2e19a05d9d9a32377dd8205e40199063a81d7e15e11b6ec6af296063090e7671d3d4214b6e3f695b587eb938732c9c8156b9174efe7ad6f28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34790.exe

Filesize
468KB

MD5
e9b74780ef4a135c2123c65468301279

SHA1
f5e39a27a02f3c8fdfe7407f90f29c68d8343b60

SHA256
e29b16bbefc76670ab459029c982cde331bb173f930bf1a144aa6f49fb713cbf

SHA512
857a2f5077f82fded5248e9a93e7c802dfaf4d1a2983c2076f019688fd59cf5b33e3ada882e9a11ce3f6d45f72ec21490cceeb7b3951e9b86bd6c372c78ec9c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe

Filesize
468KB

MD5
6c2e81ae01af237099150d1ba1ab355d

SHA1
7d88f85911bedbb378abe32c6239efa871045050

SHA256
8879cdeabeb09063899d8d3f791d7f68de356db8b2ac8dc5674f4a40256b71f7

SHA512
fcad70f805f2f82ab1e4e484b953324dfa2601e8c5c9f1193cff2d6c1a3d73aa3dc18b5ef27c8aa01af06365283a0d2d8e016ad42a0a7714cb2464e9b10bd8bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39987.exe

Filesize
468KB

MD5
6339a1fb67b5b7e3082c72698948ae09

SHA1
74202d7f924f30f6d7fb3c0811cfa46dad585789

SHA256
256b5ce5d8c03f049e0441ec18deeae01e02fa93125c248932a0a36477950a40

SHA512
d22f4730908c6fe265a41b6d0e933fe829c77bdef005831ff119ae600d2fbfadd67712b77b0219bcad9d373b8e25aba8757b503c13cb693078e1bb539b92b04a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4404.exe

Filesize
468KB

MD5
88ccd16c2b4ecbf6abb05b661c4efd0f

SHA1
a7923459df4a157703eed6b4e109098b6adbec06

SHA256
cef8905a1eecb4aed1e84b14b30a32b3dcf05b3e206cb22277c1bedbb3c723f3

SHA512
eb4d7442b49caa9caf36db3e632dfe7834bce674ea5eb645140c6da8fd0026d5581ff74c9239d391a6865ca61b005a7a2fcf992867c300ed2679ec5393b0ad21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe

Filesize
468KB

MD5
2755819147dee83bbbacdc36ed4659ba

SHA1
3ba98f4875407dcce843001841bfe91e75580a93

SHA256
2a47129953618e8c42555a9aade388bb33875c877a4bd40b9ff6c32131666c17

SHA512
22c478b0a248c5b8082b55994f2e1a591a2173a546106dde570ba9a6c9807844d585fec2fbc5274bd4abff1e3696a67c3c4fd15d864be43823dcbd12deb14a65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe

Filesize
468KB

MD5
62fdbf7cfa3f5f00110a3c784ab4c44a

SHA1
ba83784facdb96b14ef3d385fe443f3de979e150

SHA256
3f178e14c4bb3f28e793b874b573e7224c056e3ee28148d476a614def016da64

SHA512
ef6c9c06111da9054993f46194b9fb1453b4e1c8d1c80413f252908d3373d34bae664ae26622322b2d391af3f7f5c8b34c526038e7cf429fde2f332f8d1b5101

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52492.exe

Filesize
468KB

MD5
e8c01b053f856d14186f95fb6f2fe64b

SHA1
a6918c3da43344e7a22a7f190f80dfcd5013a5eb

SHA256
42ec7c87e702fa7fd892848034bd01cbff3fdc61cabd49c6daa76795a1e3d1dc

SHA512
7ccdaf157b7c2cca1cc21dee10b0e6c66fd642418693027561abe822718eec28a8a6dd5ed919b0e66a4e4f8695cc77fab53acd74c04155d3694ad5eb89abe69b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe

Filesize
468KB

MD5
7b87ab93532e6071f0e6f9429107d9ba

SHA1
78299b91ddd6029f9ed880fd2a56e57a6f5af17d

SHA256
cdfd25543447a91f772998139f1d0342b4ad98d833ae4b7e0a668bcc1f4d7f10

SHA512
8ca883837eb5fb7ebb081bb30b2cdf295027c9f40c4c42d3ab052cce95a72f53510e40689aed15cb1be2c35f2da71158543b5f96db647666b4e73fad99970560

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58444.exe

Filesize
468KB

MD5
c00a716b8c95f1bbd8d8c42c30fea6fd

SHA1
a592ea569d992c91bc2fe4654c190a91ad9a346f

SHA256
fe329a5f0b6f6ddb488ee9498b494507eb8d90a277340ece0d7880da886e2252

SHA512
31eae3cb7a1810645a695f9d8ff0fb8a5f063dc16f79069a254980b59ddafb9dcd6735bc46056475bb9ce9b93d2422fc1f657e5cf394a286a7cbfb4ff57a5c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59012.exe

Filesize
468KB

MD5
5c3a93dbcd375efffe1bbc2b7181380a

SHA1
d3cbd7e6c98cad161f0b4a791b68b09e9a9edc50

SHA256
9f9abec632cd10d93ab1c7e980e681d7dc0dd85ccfe6fea3fd710c0a6c133438

SHA512
816400a5e2473316df60ac2061556f87e2dab1f81b29df27403696a96529ff96fbdf8df8d0adfa58309d651f52f9d2e196538d4f61f84eb07f0734af397f6c50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe

Filesize
468KB

MD5
f363d9ba1fc57889238cb4a3cbb9d44a

SHA1
8f5eb53ed7e6a78d6022dab42aa3bd28ee97c277

SHA256
a83f20ba2449365a8408baeb4d46e2bb832ee16a133d696b1d9b5c05e3df9784

SHA512
e84f1f3adf8f81574b827d9c8b9177d09fda3c1494702b2e8d1820b4171bfa6d7c452f6524d991ec4b83956c28581fa0dfb239ecb0309cf8d8d5c99d4683c67e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6052.exe

Filesize
468KB

MD5
7646ed7215f61f04f54b8aea59b17556

SHA1
7dd7717fc3eb6b76ec2f52b325f8d7e8115bc93b

SHA256
207772b007938e32e1c91cc9f999fde2a80a28d69bb1af46b9dcb29ed9012def

SHA512
51aeecf739505e4a6b028ff84330fb70c2036f97738f6477cd500bf762e19808a0b3cee7ce8e03f4940da0856d9bf5471ac0e446cc10858cffc713c457e18b0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe

Filesize
468KB

MD5
7f64dc60c49dec129c8a5fceeb0676f3

SHA1
08c8850f52e65ab096341c2c6c224f9001b3d463

SHA256
be3aaa4fe0ed98fa5df62b8fc475855ed6b0cea878ebcc12be33dc71250e0064

SHA512
7750f4c9272e47f13dddd1b6f373e2f4970da99746e5f48023be4d67fec5916fe9fda52d105f1c950a5f7edae343e8a92262095d61171dff095015e3e45f2b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63013.exe

Filesize
468KB

MD5
12224f66d431f8f400d84fa6a3405676

SHA1
4367b6b2f2047fa0db7376ea8654822d22fc0c89

SHA256
18745ba6f61c3abfbec460dbcc54f627912a4e594246475e5a150ec08fdf4014

SHA512
fc44136fa5f83c90bd6e7eaa6dd87bfdb9a117e4414ea6a234d2d16cba22563b8c146a0ae7a93a3676d369947c5d061f505d06c83e10169f6e9bd376c8ae9319

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6519.exe

Filesize
468KB

MD5
d276c22a724d2cf2038a9aec587374d7

SHA1
125987841b7846690e6b0ba8881e4fcdc5b4f451

SHA256
9c5062633def769c864652489c4c9f98a392a39a1d2b06ffe97e2a36705f2b5d

SHA512
893df6e1308a5babbd808a80a83f5f376469a0c4d79e96f9ca62f60470f25e24a74ec7c7b022612d540fe5d0bd860e03e0ecc0812a66e137ef16bb9570f799e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7018.exe

Filesize
468KB

MD5
94090e1a1133d85746330e792d5fc6b6

SHA1
0c2b19a950cbdc6a9e254ec50aee06ca25ed6852

SHA256
f72d6e68b3bd735466eb03c76e36a4a7a908b9fbbbb8fa94970115d479f4b3a5

SHA512
73a6ab04517423bb5d80fd7fe8981bb0558abcdc57e0d08f98cf213e29ffcb5c4b1d071c4d1e79d70c315658cc0a0f4eaf92d1e13cbab67c677f25296d5b8a68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe

Filesize
468KB

MD5
31615d11304987ef583a10ac27e7230b

SHA1
01fe65e2aead6a6c9c3c2d269c70e1ebb68aa20e

SHA256
f3a2f2ec81bf969f669cbb22a5a7670c667b22462c2781e20898e06a203d4370

SHA512
462b4f505aa27a09be3f3ebe6ba8c8db7d1b4e6502f3197d2409c9781550a610d0712b71293552778ce8f1dad0b9dc996dbe4027957fa8d0c85967454a827092

Download Submit
memory/116-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/216-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/220-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/228-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/452-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/624-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/816-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1180-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1472-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-57-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3076-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3212-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3244-2261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3268-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3284-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3300-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3492-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3524-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3528-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3728-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3796-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3808-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3816-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3848-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3896-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3932-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4000-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4024-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4040-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4080-2256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4080-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4212-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4276-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4440-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4444-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4556-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4816-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4840-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4940-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4956-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5228-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5244-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5312-563-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5568-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/8432-3210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9228-3186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/10156-3187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads